fe37c4ba340fd9ebaf3b639cd5a4a356c2adb20e1def2e24af6f6b6ea2542ae0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041f4171d06869ca57d099752e5cc1bf.exe
Size

38KB
MD5

041f4171d06869ca57d099752e5cc1bf
SHA1

023995c6c02f34dcabffd8f79dd333f63ff6a0c5
SHA256

fe37c4ba340fd9ebaf3b639cd5a4a356c2adb20e1def2e24af6f6b6ea2542ae0
SHA512

6664852d478019d0151ff849b4ede766a468cb3bf1784f4ae9afd874ed62a123dcf34025d6b120b5f695508e12626e5c945c4c8dff8c7579de328f9171ff7ec9
SSDEEP

768:xg5idY4WSEcfw/rZ/+rNx4u8RXE4jl/i20SS68d7sHum7soV:x2KY4/3IjZ+sSWFiUSjd7CsoV

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	041f4171d06869ca57d099752e5cc1bf.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	balloon.exe
4356	msedge.exe
3224	sysguard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysguard = "C:\\Windows\\sysguard.exe"	balloon.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\sysguard.exe	balloon.exe
File created	C:\Windows\aazalirt.exe	sysguard.exe
File created	C:\Windows\jungertab.exe	sysguard.exe
File created	C:\Windows\iddqdops.exe	sysguard.exe
File created	C:\Windows\ronitfst.exe	sysguard.exe
File created	C:\Windows\salrtybek.exe	sysguard.exe
File created	C:\Windows\tobmygers.exe	sysguard.exe
File created	C:\Windows\jikglond.exe	sysguard.exe
File created	C:\Windows\klopnidret.exe	sysguard.exe
File opened for modification	C:\Windows\sysguard.exe	balloon.exe
File created	C:\Windows\skaaanret.exe	sysguard.exe
File created	C:\Windows\zibaglertz.exe	sysguard.exe
File created	C:\Windows\tobykke.exe	sysguard.exe
File created	C:\Windows\jiklagka.exe	sysguard.exe
File created	C:\Windows\seeukluba.exe	sysguard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3044	5112	WerFault.exe	14
908	4356	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4304	ping.exe
3092	ping.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3224	sysguard.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3224	sysguard.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3584	5112	041f4171d06869ca57d099752e5cc1bf.exe	33
PID 5112 wrote to memory of 3584	5112	041f4171d06869ca57d099752e5cc1bf.exe	33
PID 5112 wrote to memory of 3584	5112	041f4171d06869ca57d099752e5cc1bf.exe	33
PID 3584 wrote to memory of 4304	3584	balloon.exe	38
PID 3584 wrote to memory of 4304	3584	balloon.exe	38
PID 3584 wrote to memory of 4304	3584	balloon.exe	38
PID 5112 wrote to memory of 4356	5112	041f4171d06869ca57d099752e5cc1bf.exe	114
PID 5112 wrote to memory of 4356	5112	041f4171d06869ca57d099752e5cc1bf.exe	114
PID 5112 wrote to memory of 4356	5112	041f4171d06869ca57d099752e5cc1bf.exe	114
PID 3584 wrote to memory of 3224	3584	balloon.exe	96
PID 3584 wrote to memory of 3224	3584	balloon.exe	96
PID 3584 wrote to memory of 3224	3584	balloon.exe	96
PID 3224 wrote to memory of 3092	3224	sysguard.exe	94
PID 3224 wrote to memory of 3092	3224	sysguard.exe	94
PID 3224 wrote to memory of 3092	3224	sysguard.exe	94
PID 3224 wrote to memory of 1552	3224	sysguard.exe	112
PID 3224 wrote to memory of 1552	3224	sysguard.exe	112
PID 1552 wrote to memory of 3956	1552	msedge.exe	111
PID 1552 wrote to memory of 3956	1552	msedge.exe	111
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 2656	1552	msedge.exe	118
PID 1552 wrote to memory of 4720	1552	msedge.exe	113
PID 1552 wrote to memory of 4720	1552	msedge.exe	113
PID 1552 wrote to memory of 4356	1552	msedge.exe	114
PID 1552 wrote to memory of 4356	1552	msedge.exe	114
PID 1552 wrote to memory of 4356	1552	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\041f4171d06869ca57d099752e5cc1bf.exe
"C:\Users\Admin\AppData\Local\Temp\041f4171d06869ca57d099752e5cc1bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 424
  2⤵
  - Program crash
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\balloon.exe
  "C:\Users\Admin\AppData\Local\Temp\balloon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\ping.exe
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4304
- - C:\Windows\sysguard.exe
    "C:\Windows\sysguard.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sp-protect2009.com/?r=5
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:4356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        5⤵
        
        PID:2656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
        5⤵
        
        PID:3660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
        5⤵
        
        PID:5496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7496997157355966004,12771346124639724726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
- C:\Users\Admin\AppData\Local\Temp\load.exe
  "C:\Users\Admin\AppData\Local\Temp\load.exe"
  2⤵
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5112 -ip 5112
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 228
1⤵
- Program crash
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 4356
1⤵
PID:4872

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacd7c46f8,0x7ffacd7c4708,0x7ffacd7c4718
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HDotnJAhID

Filesize
9KB

MD5
5bac68a3ff44f3281ae5a0f9f16579ee

SHA1
cada7984ceac156cccf09e957c669003898a7ffc

SHA256
515c0c74dfcf38fad99d8a22a3c8c8d5ee12b0a78ba50a2e30db333af7599988

SHA512
e174bd26392b844874453251dab7ffb7f3ce0a978733071ab35a6a3db075c2d94d132c85d3098e8ae557272333eb54e7a9a492ce56864e8193c5d88f5c3167ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\load.exe

Filesize
8KB

MD5
22f266de5c06ee59127a619bada8c859

SHA1
3e67b340f9703ca1004cb09df74afefeca19630f

SHA256
54e3b3a7dc8ee349de43429445a00b16102b485a47f8d6b8967822ded81c0d34

SHA512
32c2dd11bb32a58492aabb8a8e41e68d20ff782d94dd64f1956e9bf141d0c66e15f305826590a37edaea978c71f02d121689557f0fbb6ae7b24cc8738137c6aa

Download Submit
memory/3224-36-0x0000000000880000-0x0000000000885000-memory.dmp

Filesize
20KB

Download
memory/5112-0-0x0000000000400000-0x0000000000411200-memory.dmp

Filesize
68KB

Download
memory/5112-31-0x0000000000400000-0x0000000000411200-memory.dmp

Filesize
68KB

Download