4db3ea89fb5802355b3f98ba8a46ccdf16e8479949f273dc20e84b20cf2d9ee7

Analysis

max time kernel
144s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
Size

76KB
MD5

079cacbaa68d0a795e25edcea3a55f80
SHA1

07244ba840907e03a54c6b65a6658cc2b39937b4
SHA256

4db3ea89fb5802355b3f98ba8a46ccdf16e8479949f273dc20e84b20cf2d9ee7
SHA512

6eb3d98b4d2d3db5daea4d9b4178c3b52df2b9345274c1907a5919e04cf94901a8d86f51f778bd9724265d4b1077a8f91d6ea21ece01285abf95f162d93056b8
SSDEEP

384:vbLwOs8AHsc4sMfwhKQLroP4/CFsrdOI1Nb7g7FX7XYfruVDtM9tQ/FKlnVwU1:vvw9816vhKQLroP4/wQRNrfrunMxVD

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}\stubpath = "C:\\Windows\\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe"	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}\stubpath = "C:\\Windows\\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe"	{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18781AAA-21FA-4e05-BAED-682384997D44}\stubpath = "C:\\Windows\\{18781AAA-21FA-4e05-BAED-682384997D44}.exe"	{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}	{18781AAA-21FA-4e05-BAED-682384997D44}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}\stubpath = "C:\\Windows\\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe"	{18781AAA-21FA-4e05-BAED-682384997D44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A85D3CD4-A342-4c73-91E3-558135F22867}	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A85D3CD4-A342-4c73-91E3-558135F22867}\stubpath = "C:\\Windows\\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe"	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88E186E4-E143-4826-9FF6-BEE502595DC2}	{36D8224E-E13C-483f-B60F-52876846B12A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}\stubpath = "C:\\Windows\\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe"	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36D8224E-E13C-483f-B60F-52876846B12A}	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36D8224E-E13C-483f-B60F-52876846B12A}\stubpath = "C:\\Windows\\{36D8224E-E13C-483f-B60F-52876846B12A}.exe"	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}\stubpath = "C:\\Windows\\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe"	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88E186E4-E143-4826-9FF6-BEE502595DC2}\stubpath = "C:\\Windows\\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe"	{36D8224E-E13C-483f-B60F-52876846B12A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}	{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18781AAA-21FA-4e05-BAED-682384997D44}	{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}\stubpath = "C:\\Windows\\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe"	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}\stubpath = "C:\\Windows\\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe"	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe

Deletes itself 1 IoCs

pid	Process
2272	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe
2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
1116	{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
1348	{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
2876	{18781AAA-21FA-4e05-BAED-682384997D44}.exe
528	{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
File created	C:\Windows\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe	{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
File created	C:\Windows\{18781AAA-21FA-4e05-BAED-682384997D44}.exe	{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
File created	C:\Windows\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe	{18781AAA-21FA-4e05-BAED-682384997D44}.exe
File created	C:\Windows\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
File created	C:\Windows\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	{36D8224E-E13C-483f-B60F-52876846B12A}.exe
File created	C:\Windows\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
File created	C:\Windows\{36D8224E-E13C-483f-B60F-52876846B12A}.exe	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
File created	C:\Windows\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
File created	C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
File created	C:\Windows\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
Token: SeIncBasePriorityPrivilege	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
Token: SeIncBasePriorityPrivilege	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
Token: SeIncBasePriorityPrivilege	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
Token: SeIncBasePriorityPrivilege	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
Token: SeIncBasePriorityPrivilege	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe
Token: SeIncBasePriorityPrivilege	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
Token: SeIncBasePriorityPrivilege	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
Token: SeIncBasePriorityPrivilege	1116	{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
Token: SeIncBasePriorityPrivilege	1348	{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
Token: SeIncBasePriorityPrivilege	2876	{18781AAA-21FA-4e05-BAED-682384997D44}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2124	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	28
PID 2468 wrote to memory of 2124	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	28
PID 2468 wrote to memory of 2124	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	28
PID 2468 wrote to memory of 2124	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	28
PID 2468 wrote to memory of 2272	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	29
PID 2468 wrote to memory of 2272	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	29
PID 2468 wrote to memory of 2272	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	29
PID 2468 wrote to memory of 2272	2468	NEAS.079cacbaa68d0a795e25edcea3a55f80.exe	29
PID 2124 wrote to memory of 2780	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	32
PID 2124 wrote to memory of 2780	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	32
PID 2124 wrote to memory of 2780	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	32
PID 2124 wrote to memory of 2780	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	32
PID 2124 wrote to memory of 2268	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	33
PID 2124 wrote to memory of 2268	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	33
PID 2124 wrote to memory of 2268	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	33
PID 2124 wrote to memory of 2268	2124	{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe	33
PID 2780 wrote to memory of 2756	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	34
PID 2780 wrote to memory of 2756	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	34
PID 2780 wrote to memory of 2756	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	34
PID 2780 wrote to memory of 2756	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	34
PID 2780 wrote to memory of 2340	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	35
PID 2780 wrote to memory of 2340	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	35
PID 2780 wrote to memory of 2340	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	35
PID 2780 wrote to memory of 2340	2780	{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe	35
PID 2756 wrote to memory of 2832	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	36
PID 2756 wrote to memory of 2832	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	36
PID 2756 wrote to memory of 2832	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	36
PID 2756 wrote to memory of 2832	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	36
PID 2756 wrote to memory of 2720	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	37
PID 2756 wrote to memory of 2720	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	37
PID 2756 wrote to memory of 2720	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	37
PID 2756 wrote to memory of 2720	2756	{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe	37
PID 2832 wrote to memory of 2868	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	38
PID 2832 wrote to memory of 2868	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	38
PID 2832 wrote to memory of 2868	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	38
PID 2832 wrote to memory of 2868	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	38
PID 2832 wrote to memory of 2640	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	39
PID 2832 wrote to memory of 2640	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	39
PID 2832 wrote to memory of 2640	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	39
PID 2832 wrote to memory of 2640	2832	{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe	39
PID 2868 wrote to memory of 2524	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	40
PID 2868 wrote to memory of 2524	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	40
PID 2868 wrote to memory of 2524	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	40
PID 2868 wrote to memory of 2524	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	40
PID 2868 wrote to memory of 2604	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	41
PID 2868 wrote to memory of 2604	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	41
PID 2868 wrote to memory of 2604	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	41
PID 2868 wrote to memory of 2604	2868	{36D8224E-E13C-483f-B60F-52876846B12A}.exe	41
PID 2524 wrote to memory of 3060	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	42
PID 2524 wrote to memory of 3060	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	42
PID 2524 wrote to memory of 3060	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	42
PID 2524 wrote to memory of 3060	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	42
PID 2524 wrote to memory of 2992	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	43
PID 2524 wrote to memory of 2992	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	43
PID 2524 wrote to memory of 2992	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	43
PID 2524 wrote to memory of 2992	2524	{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe	43
PID 3060 wrote to memory of 1116	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	44
PID 3060 wrote to memory of 1116	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	44
PID 3060 wrote to memory of 1116	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	44
PID 3060 wrote to memory of 1116	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	44
PID 3060 wrote to memory of 1940	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	45
PID 3060 wrote to memory of 1940	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	45
PID 3060 wrote to memory of 1940	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	45
PID 3060 wrote to memory of 1940	3060	{A85D3CD4-A342-4c73-91E3-558135F22867}.exe	45

C:\Users\Admin\AppData\Local\Temp\NEAS.079cacbaa68d0a795e25edcea3a55f80.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.079cacbaa68d0a795e25edcea3a55f80.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
  C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
    C:\Windows\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
      C:\Windows\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
        
        C:\Windows\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Windows\{36D8224E-E13C-483f-B60F-52876846B12A}.exe
        
        C:\Windows\{36D8224E-E13C-483f-B60F-52876846B12A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
        
        C:\Windows\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
        
        C:\Windows\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
        
        C:\Windows\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
        
        C:\Windows\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
        
        C:\Windows\{18781AAA-21FA-4e05-BAED-682384997D44}.exe
        
        C:\Windows\{18781AAA-21FA-4e05-BAED-682384997D44}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe
        
        C:\Windows\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe
        12⤵
        Executes dropped EXE
        
        PID:528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18781~1.EXE > nul
        12⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{65F83~1.EXE > nul
        11⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F0062~1.EXE > nul
        10⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A85D3~1.EXE > nul
        9⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88E18~1.EXE > nul
        8⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36D82~1.EXE > nul
        7⤵
        
        PID:2604
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20CF9~1.EXE > nul
        6⤵
        
        PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{227E5~1.EXE > nul
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FB4DD~1.EXE > nul
      4⤵
      PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{07A29~1.EXE > nul
    3⤵
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\NEAS07~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe

Filesize
76KB

MD5
d6f541f20cf91401250040809e6531a5

SHA1
b4bf57a090bbe4ee5ec96367ea338ff5a36e0780

SHA256
0dfac793be520dedc9a102fdecdf4e61edc4ebb2c7b3c64fdd765e79c785e61b

SHA512
ec40e366a0e8c074164302d01e93a807d8b930e7d3b93b1d58bf1303b06fd36dff8ef12ddbfdbb3370f710b765178c385646449aca2ba0163e79c9f984be2827

Download Submit
C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe

Filesize
76KB

MD5
d6f541f20cf91401250040809e6531a5

SHA1
b4bf57a090bbe4ee5ec96367ea338ff5a36e0780

SHA256
0dfac793be520dedc9a102fdecdf4e61edc4ebb2c7b3c64fdd765e79c785e61b

SHA512
ec40e366a0e8c074164302d01e93a807d8b930e7d3b93b1d58bf1303b06fd36dff8ef12ddbfdbb3370f710b765178c385646449aca2ba0163e79c9f984be2827

Download Submit
C:\Windows\{07A29BD7-635F-47a9-BF0A-27A1CC34BB4A}.exe

Filesize
76KB

MD5
d6f541f20cf91401250040809e6531a5

SHA1
b4bf57a090bbe4ee5ec96367ea338ff5a36e0780

SHA256
0dfac793be520dedc9a102fdecdf4e61edc4ebb2c7b3c64fdd765e79c785e61b

SHA512
ec40e366a0e8c074164302d01e93a807d8b930e7d3b93b1d58bf1303b06fd36dff8ef12ddbfdbb3370f710b765178c385646449aca2ba0163e79c9f984be2827

Download Submit
C:\Windows\{18781AAA-21FA-4e05-BAED-682384997D44}.exe

Filesize
76KB

MD5
f94592d18e00d4ffab250b2d8b8afd7f

SHA1
a1a9bb093d7f25fd9274359946bdcf09d8ee3fdc

SHA256
3616582ffe5ec207a3e8c4a3c3fe7a6f5b7ae7d76dea07a5722d3bb5e4f0197e

SHA512
0aa1fef3631af4d965877178fc9daf7d0fd834e18172ed893abe6fdfdafeee6fea2e5047ff18a2e6bc86f0d2d2926c6e88a5f309d484e278af05bdc344f4d95d

Download Submit
C:\Windows\{18781AAA-21FA-4e05-BAED-682384997D44}.exe

Filesize
76KB

MD5
f94592d18e00d4ffab250b2d8b8afd7f

SHA1
a1a9bb093d7f25fd9274359946bdcf09d8ee3fdc

SHA256
3616582ffe5ec207a3e8c4a3c3fe7a6f5b7ae7d76dea07a5722d3bb5e4f0197e

SHA512
0aa1fef3631af4d965877178fc9daf7d0fd834e18172ed893abe6fdfdafeee6fea2e5047ff18a2e6bc86f0d2d2926c6e88a5f309d484e278af05bdc344f4d95d

Download Submit
C:\Windows\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe

Filesize
76KB

MD5
36ef1d51d8e10fa591be33a5f8079e58

SHA1
a88dd5cd65bf4cd76c7daaa5c4ba73c608540124

SHA256
dc71ea55cecb93a251e42e5e27094a6536d9759e14f55621ec72d760fbdcf425

SHA512
f2725df9b7335a2150acad83d10795757eecee794673ecc8e4157ccbdab5a116e647a13bcd81efd1beaf9369ef993aabaaf2837f12e7746c464e9d949dfba28f

Download Submit
C:\Windows\{20CF970F-FA7E-42a2-9A78-82B3D22864CD}.exe

Filesize
76KB

MD5
36ef1d51d8e10fa591be33a5f8079e58

SHA1
a88dd5cd65bf4cd76c7daaa5c4ba73c608540124

SHA256
dc71ea55cecb93a251e42e5e27094a6536d9759e14f55621ec72d760fbdcf425

SHA512
f2725df9b7335a2150acad83d10795757eecee794673ecc8e4157ccbdab5a116e647a13bcd81efd1beaf9369ef993aabaaf2837f12e7746c464e9d949dfba28f

Download Submit
C:\Windows\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe

Filesize
76KB

MD5
4a6546dc5e845690fd52c491d96a26b7

SHA1
7be5b47c86c32f7dc51fd977297dbdb279f68236

SHA256
8b42624f3c0c2801efec466e92bac28663abaea0cdbde986981916ac683c20c2

SHA512
6db87f1b5c5e3b3be13c102ceb9a10f8e70d7442942dbdabe49522cf144255b30eb64e7b12a779efb474eef7c46ec470cb145a80c390b62d81ac8746dc2e7388

Download Submit
C:\Windows\{227E57D7-CDED-4f9e-8F99-2C46A7468B9F}.exe

Filesize
76KB

MD5
4a6546dc5e845690fd52c491d96a26b7

SHA1
7be5b47c86c32f7dc51fd977297dbdb279f68236

SHA256
8b42624f3c0c2801efec466e92bac28663abaea0cdbde986981916ac683c20c2

SHA512
6db87f1b5c5e3b3be13c102ceb9a10f8e70d7442942dbdabe49522cf144255b30eb64e7b12a779efb474eef7c46ec470cb145a80c390b62d81ac8746dc2e7388

Download Submit
C:\Windows\{36D8224E-E13C-483f-B60F-52876846B12A}.exe

Filesize
76KB

MD5
13e6e772f368ff8289ab0353eeba4cd4

SHA1
520f3954fc07a2c54899c60f6a30b3d2d8559992

SHA256
36738c528bb2e12a2d200ff0a49c0cfd66a84b04ea3bb5293cf8a0a8d9c86901

SHA512
4836ec941ced0b72974b20705db14c39770c0367986be54c989d1976f43d5edb26a81cf417f70d2c77a7a73a016b374883ead7a34bfe88d7beb43e4f5d90395f

Download Submit
C:\Windows\{36D8224E-E13C-483f-B60F-52876846B12A}.exe

Filesize
76KB

MD5
13e6e772f368ff8289ab0353eeba4cd4

SHA1
520f3954fc07a2c54899c60f6a30b3d2d8559992

SHA256
36738c528bb2e12a2d200ff0a49c0cfd66a84b04ea3bb5293cf8a0a8d9c86901

SHA512
4836ec941ced0b72974b20705db14c39770c0367986be54c989d1976f43d5edb26a81cf417f70d2c77a7a73a016b374883ead7a34bfe88d7beb43e4f5d90395f

Download Submit
C:\Windows\{5A789D84-C5B9-4bb4-81A8-51BDD1FFDF8F}.exe

Filesize
76KB

MD5
91bf0a3db4b91d215a2f70fd9c735406

SHA1
498b5a3cdb5abbcdcdfd044f9f611709f1c66135

SHA256
c0bbed5fb8478337fc233076cf423bda73229e0f71c7b4798b731c901e111f29

SHA512
324059042ed43f6e2ef9809d5b8a088b3188b51ef3c981e02a8d7a6d23889e9a1fdb43e035fa6dcccc0eaff6c58f4525d12e2ab45f8de12c8744eaec98fa4b52

Download Submit
C:\Windows\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe

Filesize
76KB

MD5
d92c6705303a4fafe5c5a22daef12be7

SHA1
d3787a095344be6e869ede5283a6277fea95e962

SHA256
04a5817101322bc493c43830a9b2b0b1e36e6506b4658fc204ca81d00934fc5b

SHA512
e67cfb26ddecb806b4098a49b2d58c60b4b6f40aed2870374cc1c898a4d7d2d349d255acb03036227daaa2cb32f7491664c6c43ee38ca2646fa4564c6bc338df

Download Submit
C:\Windows\{65F83B66-3205-4ba5-AD9E-53BE751FDDC9}.exe

Filesize
76KB

MD5
d92c6705303a4fafe5c5a22daef12be7

SHA1
d3787a095344be6e869ede5283a6277fea95e962

SHA256
04a5817101322bc493c43830a9b2b0b1e36e6506b4658fc204ca81d00934fc5b

SHA512
e67cfb26ddecb806b4098a49b2d58c60b4b6f40aed2870374cc1c898a4d7d2d349d255acb03036227daaa2cb32f7491664c6c43ee38ca2646fa4564c6bc338df

Download Submit
C:\Windows\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe

Filesize
76KB

MD5
4279d8d3bb9e720b440bd0522e2f2c66

SHA1
741d279a2b83d7eeb6b13297174ce36fe617592b

SHA256
6546ec2de7df6c9ffcf01462eed2ea5f9f8d9a4d578c5fc45c5e85b9dcb2ec74

SHA512
d515cd51031674f567efa50de9fa6c235fd68765211c704dd95244c073d222deef81ba5737e6a822a9c37fc0ead311529b1937e30596240e15d7fa5f545ceb3a

Download Submit
C:\Windows\{88E186E4-E143-4826-9FF6-BEE502595DC2}.exe

Filesize
76KB

MD5
4279d8d3bb9e720b440bd0522e2f2c66

SHA1
741d279a2b83d7eeb6b13297174ce36fe617592b

SHA256
6546ec2de7df6c9ffcf01462eed2ea5f9f8d9a4d578c5fc45c5e85b9dcb2ec74

SHA512
d515cd51031674f567efa50de9fa6c235fd68765211c704dd95244c073d222deef81ba5737e6a822a9c37fc0ead311529b1937e30596240e15d7fa5f545ceb3a

Download Submit
C:\Windows\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe

Filesize
76KB

MD5
7d5862f9d1a211b76a41b1a3db03e392

SHA1
5a1be9038d1c706e17f4d9e619bba1f00f027757

SHA256
822ff3e322825aac231be36071f34317b49ce9c5007760b15fa9881439a71f7e

SHA512
7970625a066d839ed30714a065b9213da998409a7b9f56fa6f4b7a55c5c1c95cc6cd860b807d78e76575e4d68a2904e7a08ee9298bfb494aae0d8f2c1eabcd55

Download Submit
C:\Windows\{A85D3CD4-A342-4c73-91E3-558135F22867}.exe

Filesize
76KB

MD5
7d5862f9d1a211b76a41b1a3db03e392

SHA1
5a1be9038d1c706e17f4d9e619bba1f00f027757

SHA256
822ff3e322825aac231be36071f34317b49ce9c5007760b15fa9881439a71f7e

SHA512
7970625a066d839ed30714a065b9213da998409a7b9f56fa6f4b7a55c5c1c95cc6cd860b807d78e76575e4d68a2904e7a08ee9298bfb494aae0d8f2c1eabcd55

Download Submit
C:\Windows\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe

Filesize
76KB

MD5
53add9974cb6d9c4fc99345d546c3744

SHA1
b02790291c68dfc68da218923448a16428945a74

SHA256
1b0979c89ce1b4a9ec13bc7adfbcd87d2d29a93bd615e77c5ef0d1f24ebb9a38

SHA512
4c14a4ccbdf83cce6fc6dd7f7581fdc65301b1f2a5cce4f927d7ca4bd69ef96713e2997c746c6756798ad6a1e1283a569abd0db9114f6a13fac1ac62b8cf7abb

Download Submit
C:\Windows\{F0062E3E-A7D9-4fd7-A037-13B758F469A3}.exe

Filesize
76KB

MD5
53add9974cb6d9c4fc99345d546c3744

SHA1
b02790291c68dfc68da218923448a16428945a74

SHA256
1b0979c89ce1b4a9ec13bc7adfbcd87d2d29a93bd615e77c5ef0d1f24ebb9a38

SHA512
4c14a4ccbdf83cce6fc6dd7f7581fdc65301b1f2a5cce4f927d7ca4bd69ef96713e2997c746c6756798ad6a1e1283a569abd0db9114f6a13fac1ac62b8cf7abb

Download Submit
C:\Windows\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe

Filesize
76KB

MD5
11443ebea14db0528d057690b93b605c

SHA1
cb3f6331d5d5270747e8dbf76000bc13619086ef

SHA256
9e72d04a2a64b33b6fbf0c36f093238ed1cc949ed7364a39959cd51410063811

SHA512
b1bca0c7a6dd749f5bd0abaf634b4ddccaf9f483818aaca31547f5c5ce2978f489a7bc59c51d7a35b60f36d25c22e8e2aec6e0278f4928781002afc755b1b785

Download Submit
C:\Windows\{FB4DDE49-1CF4-408b-B3B4-66685410A3A8}.exe

Filesize
76KB

MD5
11443ebea14db0528d057690b93b605c

SHA1
cb3f6331d5d5270747e8dbf76000bc13619086ef

SHA256
9e72d04a2a64b33b6fbf0c36f093238ed1cc949ed7364a39959cd51410063811

SHA512
b1bca0c7a6dd749f5bd0abaf634b4ddccaf9f483818aaca31547f5c5ce2978f489a7bc59c51d7a35b60f36d25c22e8e2aec6e0278f4928781002afc755b1b785

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads