575ccdd9f82bf906196cc12647340608423a003bfe15b6c6575e64f1d44b0e2e

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fec663eccd91c1exeexeexeex.exe
Size

216KB
MD5

fec663eccd91c12343de41036e8a027b
SHA1

b1543507fc3263dd055afd99c36b8910e0d73baf
SHA256

575ccdd9f82bf906196cc12647340608423a003bfe15b6c6575e64f1d44b0e2e
SHA512

141d385df07a3980dec4e65cc521ebaa5e3b6467da3b15da300797d2bc49acd4522a5decf21c762b942fba348ada8f83275a780d117b89274fd8d2755de04515
SSDEEP

3072:jEGh0o/l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGFlEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{320631B5-1776-428f-A344-A47AA8015164}\stubpath = "C:\\Windows\\{320631B5-1776-428f-A344-A47AA8015164}.exe"	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{130E3739-B73B-4a3c-A1BB-51DD385871BE}	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{130E3739-B73B-4a3c-A1BB-51DD385871BE}\stubpath = "C:\\Windows\\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe"	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{320631B5-1776-428f-A344-A47AA8015164}	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F51860F-84D9-4a9f-9859-C2246532AABE}\stubpath = "C:\\Windows\\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe"	{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7303B104-8FF3-40d0-9CC8-216E71371CBE}	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}\stubpath = "C:\\Windows\\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe"	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}\stubpath = "C:\\Windows\\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe"	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}	fec663eccd91c1exeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}\stubpath = "C:\\Windows\\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe"	fec663eccd91c1exeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}\stubpath = "C:\\Windows\\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe"	{320631B5-1776-428f-A344-A47AA8015164}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55453D7F-F81C-4e98-B59E-18FFE40F928B}\stubpath = "C:\\Windows\\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe"	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}\stubpath = "C:\\Windows\\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe"	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55453D7F-F81C-4e98-B59E-18FFE40F928B}	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F51860F-84D9-4a9f-9859-C2246532AABE}	{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}\stubpath = "C:\\Windows\\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe"	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7303B104-8FF3-40d0-9CC8-216E71371CBE}\stubpath = "C:\\Windows\\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe"	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}\stubpath = "C:\\Windows\\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe"	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}	{320631B5-1776-428f-A344-A47AA8015164}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe

Executes dropped EXE 12 IoCs

pid	Process
4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
3228	{320631B5-1776-428f-A344-A47AA8015164}.exe
2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
4412	{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
4344	{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
File created	C:\Windows\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
File created	C:\Windows\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
File created	C:\Windows\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe	{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
File created	C:\Windows\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	{320631B5-1776-428f-A344-A47AA8015164}.exe
File created	C:\Windows\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
File created	C:\Windows\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
File created	C:\Windows\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	fec663eccd91c1exeexeexeex.exe
File created	C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
File created	C:\Windows\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
File created	C:\Windows\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
File created	C:\Windows\{320631B5-1776-428f-A344-A47AA8015164}.exe	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4680	fec663eccd91c1exeexeexeex.exe
Token: SeIncBasePriorityPrivilege	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
Token: SeIncBasePriorityPrivilege	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
Token: SeIncBasePriorityPrivilege	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
Token: SeIncBasePriorityPrivilege	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
Token: SeIncBasePriorityPrivilege	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
Token: SeIncBasePriorityPrivilege	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
Token: SeIncBasePriorityPrivilege	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe
Token: SeIncBasePriorityPrivilege	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
Token: SeIncBasePriorityPrivilege	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
Token: SeIncBasePriorityPrivilege	4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
Token: SeIncBasePriorityPrivilege	4412	{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4168	4680	fec663eccd91c1exeexeexeex.exe	94
PID 4680 wrote to memory of 4168	4680	fec663eccd91c1exeexeexeex.exe	94
PID 4680 wrote to memory of 4168	4680	fec663eccd91c1exeexeexeex.exe	94
PID 4680 wrote to memory of 4472	4680	fec663eccd91c1exeexeexeex.exe	95
PID 4680 wrote to memory of 4472	4680	fec663eccd91c1exeexeexeex.exe	95
PID 4680 wrote to memory of 4472	4680	fec663eccd91c1exeexeexeex.exe	95
PID 4168 wrote to memory of 4912	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	98
PID 4168 wrote to memory of 4912	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	98
PID 4168 wrote to memory of 4912	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	98
PID 4168 wrote to memory of 4208	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	99
PID 4168 wrote to memory of 4208	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	99
PID 4168 wrote to memory of 4208	4168	{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe	99
PID 4912 wrote to memory of 1292	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	101
PID 4912 wrote to memory of 1292	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	101
PID 4912 wrote to memory of 1292	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	101
PID 4912 wrote to memory of 3208	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	102
PID 4912 wrote to memory of 3208	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	102
PID 4912 wrote to memory of 3208	4912	{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe	102
PID 1292 wrote to memory of 3964	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	103
PID 1292 wrote to memory of 3964	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	103
PID 1292 wrote to memory of 3964	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	103
PID 1292 wrote to memory of 4796	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	104
PID 1292 wrote to memory of 4796	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	104
PID 1292 wrote to memory of 4796	1292	{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe	104
PID 3964 wrote to memory of 3744	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	105
PID 3964 wrote to memory of 3744	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	105
PID 3964 wrote to memory of 3744	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	105
PID 3964 wrote to memory of 1940	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	106
PID 3964 wrote to memory of 1940	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	106
PID 3964 wrote to memory of 1940	3964	{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe	106
PID 3744 wrote to memory of 4112	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	107
PID 3744 wrote to memory of 4112	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	107
PID 3744 wrote to memory of 4112	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	107
PID 3744 wrote to memory of 2980	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	108
PID 3744 wrote to memory of 2980	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	108
PID 3744 wrote to memory of 2980	3744	{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe	108
PID 4112 wrote to memory of 3228	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	109
PID 4112 wrote to memory of 3228	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	109
PID 4112 wrote to memory of 3228	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	109
PID 4112 wrote to memory of 2512	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	110
PID 4112 wrote to memory of 2512	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	110
PID 4112 wrote to memory of 2512	4112	{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe	110
PID 3228 wrote to memory of 2156	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	111
PID 3228 wrote to memory of 2156	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	111
PID 3228 wrote to memory of 2156	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	111
PID 3228 wrote to memory of 1012	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	112
PID 3228 wrote to memory of 1012	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	112
PID 3228 wrote to memory of 1012	3228	{320631B5-1776-428f-A344-A47AA8015164}.exe	112
PID 2156 wrote to memory of 5004	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	113
PID 2156 wrote to memory of 5004	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	113
PID 2156 wrote to memory of 5004	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	113
PID 2156 wrote to memory of 3752	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	114
PID 2156 wrote to memory of 3752	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	114
PID 2156 wrote to memory of 3752	2156	{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe	114
PID 5004 wrote to memory of 4452	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	115
PID 5004 wrote to memory of 4452	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	115
PID 5004 wrote to memory of 4452	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	115
PID 5004 wrote to memory of 3868	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	116
PID 5004 wrote to memory of 3868	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	116
PID 5004 wrote to memory of 3868	5004	{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe	116
PID 4452 wrote to memory of 4412	4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe	117
PID 4452 wrote to memory of 4412	4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe	117
PID 4452 wrote to memory of 4412	4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe	117
PID 4452 wrote to memory of 3872	4452	{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe	118

C:\Users\Admin\AppData\Local\Temp\fec663eccd91c1exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\fec663eccd91c1exeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
  C:\Windows\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
    C:\Windows\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
      C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
        
        C:\Windows\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3964
      - C:\Windows\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
        
        C:\Windows\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
        
        C:\Windows\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\{320631B5-1776-428f-A344-A47AA8015164}.exe
        
        C:\Windows\{320631B5-1776-428f-A344-A47AA8015164}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
        
        C:\Windows\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
        
        C:\Windows\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
        
        C:\Windows\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
        
        C:\Windows\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
        
        C:\Windows\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe
        
        C:\Windows\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe
        13⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{55453~1.EXE > nul
        13⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D378~1.EXE > nul
        12⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71E06~1.EXE > nul
        11⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4C079~1.EXE > nul
        10⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32063~1.EXE > nul
        9⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E00A~1.EXE > nul
        8⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{264DC~1.EXE > nul
        7⤵
        
        PID:2980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7303B~1.EXE > nul
        6⤵
        
        PID:1940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{130E3~1.EXE > nul
        5⤵
        
        PID:4796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B1E7A~1.EXE > nul
      4⤵
      PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2E90D~1.EXE > nul
    3⤵
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\FEC663~1.EXE > nul
  2⤵
  PID:4472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe

Filesize
216KB

MD5
4db3ee75cce550db3b3de6933ec0e90c

SHA1
47c8a34da00049e7f7abe3aacdff1c87452509e7

SHA256
5f2634920439a88e2dc8016e5bcca7b2ade32291b5bccc90b44b37e2088835a7

SHA512
8347382c50d87313da1335375fc42fa583038b382a130fccaf02c3eeec1f5e47f438fecff46fbe83e8ee43fc1b9746071b95b6ecaf85750b4fa9bf44b77b3d0a

Download Submit
C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe

Filesize
216KB

MD5
4db3ee75cce550db3b3de6933ec0e90c

SHA1
47c8a34da00049e7f7abe3aacdff1c87452509e7

SHA256
5f2634920439a88e2dc8016e5bcca7b2ade32291b5bccc90b44b37e2088835a7

SHA512
8347382c50d87313da1335375fc42fa583038b382a130fccaf02c3eeec1f5e47f438fecff46fbe83e8ee43fc1b9746071b95b6ecaf85750b4fa9bf44b77b3d0a

Download Submit
C:\Windows\{130E3739-B73B-4a3c-A1BB-51DD385871BE}.exe

Filesize
216KB

MD5
4db3ee75cce550db3b3de6933ec0e90c

SHA1
47c8a34da00049e7f7abe3aacdff1c87452509e7

SHA256
5f2634920439a88e2dc8016e5bcca7b2ade32291b5bccc90b44b37e2088835a7

SHA512
8347382c50d87313da1335375fc42fa583038b382a130fccaf02c3eeec1f5e47f438fecff46fbe83e8ee43fc1b9746071b95b6ecaf85750b4fa9bf44b77b3d0a

Download Submit
C:\Windows\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe

Filesize
216KB

MD5
c7b4107c33aaa453138b17aca20103c9

SHA1
cdc9e42a9721923cf7b181ade84004e6298867d9

SHA256
bca9c444f07f01c2cde216f1b43063a78fbfe1a2e2eb5bd1efa3cb5a9565ee01

SHA512
039ca10b6d3e7fc2e61a3052367d0c7000c8280b53241cc4a99b085acd1eb753c756b444a29f5755f31e19937a49e6dc73c04424a36c3f25c9b8529ca0aed6bc

Download Submit
C:\Windows\{264DCA20-5F03-49b8-9EF4-6742FFDA63E2}.exe

Filesize
216KB

MD5
c7b4107c33aaa453138b17aca20103c9

SHA1
cdc9e42a9721923cf7b181ade84004e6298867d9

SHA256
bca9c444f07f01c2cde216f1b43063a78fbfe1a2e2eb5bd1efa3cb5a9565ee01

SHA512
039ca10b6d3e7fc2e61a3052367d0c7000c8280b53241cc4a99b085acd1eb753c756b444a29f5755f31e19937a49e6dc73c04424a36c3f25c9b8529ca0aed6bc

Download Submit
C:\Windows\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe

Filesize
216KB

MD5
5b620eb5e6a20bc3d5ecc4d31c711e8a

SHA1
ed058294c8e0decaff603716557c76f6e736a6ac

SHA256
c8ce869213edf770f1dded6a3d301908a011c77796494f7770a83a2bf404b268

SHA512
712eac2b9b8b58febc16c225d5a48f94702bec5007b599202d11ec5769f839179f6c3eb45f2b6e3d8a4f0f14fc9e34454ef1def4eadaec0273b47b38bcdf2a6e

Download Submit
C:\Windows\{2E90DF19-9A62-40b4-BDDF-2C575991D2D2}.exe

Filesize
216KB

MD5
5b620eb5e6a20bc3d5ecc4d31c711e8a

SHA1
ed058294c8e0decaff603716557c76f6e736a6ac

SHA256
c8ce869213edf770f1dded6a3d301908a011c77796494f7770a83a2bf404b268

SHA512
712eac2b9b8b58febc16c225d5a48f94702bec5007b599202d11ec5769f839179f6c3eb45f2b6e3d8a4f0f14fc9e34454ef1def4eadaec0273b47b38bcdf2a6e

Download Submit
C:\Windows\{320631B5-1776-428f-A344-A47AA8015164}.exe

Filesize
216KB

MD5
33dbb8bef58dbe7fc103494c22f9557e

SHA1
777824037c5c1d5a1b2856fd7d4bb7fd4b098c61

SHA256
0f293cc236e60fa2e46d4bb818762728d6b6d387c296be7aa505f71c40ff8e5c

SHA512
27cfd255750cc1d90dcedbd2876c2a8107a6383d5d84c12d587ed616451a427e3e35b635be014876344e814cc54a7ce010ab87557b6ccc0603cbcb5cb5afda20

Download Submit
C:\Windows\{320631B5-1776-428f-A344-A47AA8015164}.exe

Filesize
216KB

MD5
33dbb8bef58dbe7fc103494c22f9557e

SHA1
777824037c5c1d5a1b2856fd7d4bb7fd4b098c61

SHA256
0f293cc236e60fa2e46d4bb818762728d6b6d387c296be7aa505f71c40ff8e5c

SHA512
27cfd255750cc1d90dcedbd2876c2a8107a6383d5d84c12d587ed616451a427e3e35b635be014876344e814cc54a7ce010ab87557b6ccc0603cbcb5cb5afda20

Download Submit
C:\Windows\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe

Filesize
216KB

MD5
6fbf8f25e3bf4c5ec871e894f5509751

SHA1
9eb7ed29037420adef35cf0674b109c853469599

SHA256
5cd7cb08478126cc49afc3a54e1422c1a62a0ab846a619ac32255d47289aa80c

SHA512
a13c63c431dc7d296350f02ea6ba7f27596eae6850344dcb9576d78994007d6118ce48a01637afa38a26fe3f8619fdc63f747df188e349f8a3d8e5dec0baf1d2

Download Submit
C:\Windows\{3D3787A9-A4FE-4bbf-A696-0FCAE047411D}.exe

Filesize
216KB

MD5
6fbf8f25e3bf4c5ec871e894f5509751

SHA1
9eb7ed29037420adef35cf0674b109c853469599

SHA256
5cd7cb08478126cc49afc3a54e1422c1a62a0ab846a619ac32255d47289aa80c

SHA512
a13c63c431dc7d296350f02ea6ba7f27596eae6850344dcb9576d78994007d6118ce48a01637afa38a26fe3f8619fdc63f747df188e349f8a3d8e5dec0baf1d2

Download Submit
C:\Windows\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe

Filesize
216KB

MD5
ccda0a495e93a4c8cfcfb86af67305ce

SHA1
71c1e66dbb12ed330caf5ea8ed3baf8d90cb86b4

SHA256
a5f6c11ed602130e634187975d61d292a16e8da803bc3f57ae7678fc8753137d

SHA512
5373fb4cf3595f982d0532728ec775ac6dca00a5f2ba0e277d3caa81bcb494214d69b1abbc3a0390b2612aba694ecd2cdce0f2dc91a6c92f15cc802333dba527

Download Submit
C:\Windows\{4C07968C-C07A-4aaa-B6E9-5E16AFAE2C95}.exe

Filesize
216KB

MD5
ccda0a495e93a4c8cfcfb86af67305ce

SHA1
71c1e66dbb12ed330caf5ea8ed3baf8d90cb86b4

SHA256
a5f6c11ed602130e634187975d61d292a16e8da803bc3f57ae7678fc8753137d

SHA512
5373fb4cf3595f982d0532728ec775ac6dca00a5f2ba0e277d3caa81bcb494214d69b1abbc3a0390b2612aba694ecd2cdce0f2dc91a6c92f15cc802333dba527

Download Submit
C:\Windows\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe

Filesize
216KB

MD5
9c56d957c20e1a2100e96258d42161a3

SHA1
9e223e3e1268592e7cb89d235a87d797ad6143d3

SHA256
926bdd173d43708b7fbce838887e45e99fa3d4bc8b4cf3cbcf6e14c6433423b8

SHA512
af4d2c5e7980b3e86047d5a9691b84f50932ee5f919076d554099ab65713f406fb4b5bbe6044e703bce3d82286bd4f94541279cd354b83068cc1933e19c5b59c

Download Submit
C:\Windows\{55453D7F-F81C-4e98-B59E-18FFE40F928B}.exe

Filesize
216KB

MD5
9c56d957c20e1a2100e96258d42161a3

SHA1
9e223e3e1268592e7cb89d235a87d797ad6143d3

SHA256
926bdd173d43708b7fbce838887e45e99fa3d4bc8b4cf3cbcf6e14c6433423b8

SHA512
af4d2c5e7980b3e86047d5a9691b84f50932ee5f919076d554099ab65713f406fb4b5bbe6044e703bce3d82286bd4f94541279cd354b83068cc1933e19c5b59c

Download Submit
C:\Windows\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe

Filesize
216KB

MD5
06eb628b77f7b7a1daa2d534f4705342

SHA1
0b8035511d803b443a4f4e88c4f75d6aa7ea4bc4

SHA256
c9a6a979e2ee1d36b488d3fd86ebb6a613c186301ccc118444b597477b5f49ec

SHA512
571839694cdc9cc9e6547cdb5b39825833bf11c4ec70c12a416dcd4419b3b1f4bcae887a59d2538635d0315b803b0830de98befeb524e787136db6b258d663b6

Download Submit
C:\Windows\{71E062EC-2467-4aa2-ADDB-02FBCBC3C5BF}.exe

Filesize
216KB

MD5
06eb628b77f7b7a1daa2d534f4705342

SHA1
0b8035511d803b443a4f4e88c4f75d6aa7ea4bc4

SHA256
c9a6a979e2ee1d36b488d3fd86ebb6a613c186301ccc118444b597477b5f49ec

SHA512
571839694cdc9cc9e6547cdb5b39825833bf11c4ec70c12a416dcd4419b3b1f4bcae887a59d2538635d0315b803b0830de98befeb524e787136db6b258d663b6

Download Submit
C:\Windows\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe

Filesize
216KB

MD5
a87d22974cbb0dd2deb4ad73adcad431

SHA1
61eaa4d855bca3d3605f1f4af43a7839907c4b11

SHA256
0d1ac332554b3011cdd291734516b36fe36ae14ee34b287e31455785411de3f5

SHA512
e370f98a8e39377a1a6456cf4ace5536ea87a67fc41ae57a1f629510b426726d66a9e2755309e4776ea189f7a1acc6cbec94cf5d15bbff56ede0635d6b8385f0

Download Submit
C:\Windows\{7303B104-8FF3-40d0-9CC8-216E71371CBE}.exe

Filesize
216KB

MD5
a87d22974cbb0dd2deb4ad73adcad431

SHA1
61eaa4d855bca3d3605f1f4af43a7839907c4b11

SHA256
0d1ac332554b3011cdd291734516b36fe36ae14ee34b287e31455785411de3f5

SHA512
e370f98a8e39377a1a6456cf4ace5536ea87a67fc41ae57a1f629510b426726d66a9e2755309e4776ea189f7a1acc6cbec94cf5d15bbff56ede0635d6b8385f0

Download Submit
C:\Windows\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe

Filesize
216KB

MD5
9c83c1eaf1a5013f2025649a40bee2db

SHA1
88b6c9c6bdbd3697f693cf378647c993c2f2b819

SHA256
2803cb8d5db877f348a44d91a09ecb5238ad01272e338e636a70359cda4e4e14

SHA512
dd82fedadcb44a193c2f5b0df8c4e1f57a167455f9618e7f3dd64819dccaf75c6d90937ee89c43d0bb0a2c1bab3ac082ceef257d3a1b9cebb13323ebd91724c0

Download Submit
C:\Windows\{9E00ADCF-E9BD-4c08-87E4-AE29B5F3D56C}.exe

Filesize
216KB

MD5
9c83c1eaf1a5013f2025649a40bee2db

SHA1
88b6c9c6bdbd3697f693cf378647c993c2f2b819

SHA256
2803cb8d5db877f348a44d91a09ecb5238ad01272e338e636a70359cda4e4e14

SHA512
dd82fedadcb44a193c2f5b0df8c4e1f57a167455f9618e7f3dd64819dccaf75c6d90937ee89c43d0bb0a2c1bab3ac082ceef257d3a1b9cebb13323ebd91724c0

Download Submit
C:\Windows\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe

Filesize
216KB

MD5
403b0918b6aea249ce99bae9e0ccd339

SHA1
61ea655c77e79ed4c27dd42b3714072ed1eed3d3

SHA256
24ad33182002699121fe940c75e31ccd3eb2e680103b92b599c4a81849847506

SHA512
4822549e1b2743bae2e9141c029572b3704b7198856810c4c3654ece2c018f4f3aa5920427bd9b32628a0d5e6135db344c712b09420b150168f861c6884d29ff

Download Submit
C:\Windows\{9F51860F-84D9-4a9f-9859-C2246532AABE}.exe

Filesize
216KB

MD5
403b0918b6aea249ce99bae9e0ccd339

SHA1
61ea655c77e79ed4c27dd42b3714072ed1eed3d3

SHA256
24ad33182002699121fe940c75e31ccd3eb2e680103b92b599c4a81849847506

SHA512
4822549e1b2743bae2e9141c029572b3704b7198856810c4c3654ece2c018f4f3aa5920427bd9b32628a0d5e6135db344c712b09420b150168f861c6884d29ff

Download Submit
C:\Windows\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe

Filesize
216KB

MD5
6a51f390804cb2788a32ace340982bfa

SHA1
e1407d62e6dbbb541ea9f1d8033add4b72526363

SHA256
c6c46d7c0196bbf551def9192da3fb78aae70c14d09506b2b558236c56386ba4

SHA512
4969d33cd5de443007d4a3d14b8f31db01480caf4c8f87198e19202d679f5eb139d7b2020bb3ae661ccb594789eda0e517a300063a8d3496162c67b77c294dc8

Download Submit
C:\Windows\{B1E7A6FA-EE80-4cb8-BC50-F161AF43F627}.exe

Filesize
216KB

MD5
6a51f390804cb2788a32ace340982bfa

SHA1
e1407d62e6dbbb541ea9f1d8033add4b72526363

SHA256
c6c46d7c0196bbf551def9192da3fb78aae70c14d09506b2b558236c56386ba4

SHA512
4969d33cd5de443007d4a3d14b8f31db01480caf4c8f87198e19202d679f5eb139d7b2020bb3ae661ccb594789eda0e517a300063a8d3496162c67b77c294dc8

Download Submit