27a4bb4a2707a359b525e88c707e09d86c351b8813b4310c4f981883fa7fad7f

Analysis

max time kernel
167s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21888225e7ad34f11b2429351738a7eb.exe
Size

269KB
MD5

21888225e7ad34f11b2429351738a7eb
SHA1

0fdc60e4033daf3d5c8b459c3c23e2c27b9c6137
SHA256

27a4bb4a2707a359b525e88c707e09d86c351b8813b4310c4f981883fa7fad7f
SHA512

13fa41bef9a0d653b64a03e34776f71315fbea57dfd0857cc53831636156db3054c35bd0b048b3a68eb4ca13241dfd73ed91b0f0a99a2a88dd1aa2b615b345e8
SSDEEP

3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVpuJxmK:ZY7xh6SZI4z7FSVpuJxmK

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wgkou.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wvahfwa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wjsw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wyvlgs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wsng.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wvxototfo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wvkwqa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wywpbp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	21888225e7ad34f11b2429351738a7eb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wmayg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wkdil.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wxyrmcpkw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wds.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	whmsgjkra.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wwjlcnwtx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wdpvrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wknwucewh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	wyhux.exe

Executes dropped EXE 18 IoCs

pid	Process
2648	wwjlcnwtx.exe
2672	wjsw.exe
2688	wmayg.exe
4384	wknwucewh.exe
4788	wyhux.exe
1104	wsng.exe
2936	wyvlgs.exe
4940	wvxototfo.exe
3684	wvkwqa.exe
2248	wdpvrt.exe
2220	wkdil.exe
4656	wywpbp.exe
3372	wgkou.exe
8	wxyrmcpkw.exe
2948	wds.exe
2408	wvahfwa.exe
1892	whmsgjkra.exe
3684	wihadnsb.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wxyrmcpkw.exe	wgkou.exe
File created	C:\Windows\SysWOW64\wjsw.exe	wwjlcnwtx.exe
File created	C:\Windows\SysWOW64\wgkou.exe	wywpbp.exe
File created	C:\Windows\SysWOW64\wvahfwa.exe	wds.exe
File created	C:\Windows\SysWOW64\wsng.exe	wyhux.exe
File opened for modification	C:\Windows\SysWOW64\wkdil.exe	wdpvrt.exe
File opened for modification	C:\Windows\SysWOW64\wvahfwa.exe	wds.exe
File opened for modification	C:\Windows\SysWOW64\whmsgjkra.exe	wvahfwa.exe
File created	C:\Windows\SysWOW64\wmayg.exe	wjsw.exe
File opened for modification	C:\Windows\SysWOW64\wsng.exe	wyhux.exe
File created	C:\Windows\SysWOW64\wyvlgs.exe	wsng.exe
File opened for modification	C:\Windows\SysWOW64\wvkwqa.exe	wvxototfo.exe
File created	C:\Windows\SysWOW64\wywpbp.exe	wkdil.exe
File opened for modification	C:\Windows\SysWOW64\wywpbp.exe	wkdil.exe
File opened for modification	C:\Windows\SysWOW64\wknwucewh.exe	wmayg.exe
File created	C:\Windows\SysWOW64\wdpvrt.exe	wvkwqa.exe
File created	C:\Windows\SysWOW64\wkdil.exe	wdpvrt.exe
File created	C:\Windows\SysWOW64\wxyrmcpkw.exe	wgkou.exe
File created	C:\Windows\SysWOW64\wds.exe	wxyrmcpkw.exe
File created	C:\Windows\SysWOW64\wqofmtef.exe	wihadnsb.exe
File created	C:\Windows\SysWOW64\wwjlcnwtx.exe	21888225e7ad34f11b2429351738a7eb.exe
File opened for modification	C:\Windows\SysWOW64\wjsw.exe	wwjlcnwtx.exe
File created	C:\Windows\SysWOW64\wyhux.exe	wknwucewh.exe
File opened for modification	C:\Windows\SysWOW64\wyhux.exe	wknwucewh.exe
File created	C:\Windows\SysWOW64\whmsgjkra.exe	wvahfwa.exe
File opened for modification	C:\Windows\SysWOW64\wihadnsb.exe	whmsgjkra.exe
File opened for modification	C:\Windows\SysWOW64\wwjlcnwtx.exe	21888225e7ad34f11b2429351738a7eb.exe
File opened for modification	C:\Windows\SysWOW64\wvxototfo.exe	wyvlgs.exe
File created	C:\Windows\SysWOW64\wvkwqa.exe	wvxototfo.exe
File opened for modification	C:\Windows\SysWOW64\wdpvrt.exe	wvkwqa.exe
File opened for modification	C:\Windows\SysWOW64\wyvlgs.exe	wsng.exe
File created	C:\Windows\SysWOW64\wknwucewh.exe	wmayg.exe
File created	C:\Windows\SysWOW64\wvxototfo.exe	wyvlgs.exe
File opened for modification	C:\Windows\SysWOW64\wgkou.exe	wywpbp.exe
File opened for modification	C:\Windows\SysWOW64\wds.exe	wxyrmcpkw.exe
File created	C:\Windows\SysWOW64\wihadnsb.exe	whmsgjkra.exe
File opened for modification	C:\Windows\SysWOW64\wmayg.exe	wjsw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2300	4548	WerFault.exe	87
5092	4788	WerFault.exe	118
4376	4788	WerFault.exe	118
4172	3684	WerFault.exe	136
2456	3372	WerFault.exe	155

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2648	4548	21888225e7ad34f11b2429351738a7eb.exe	96
PID 4548 wrote to memory of 2648	4548	21888225e7ad34f11b2429351738a7eb.exe	96
PID 4548 wrote to memory of 2648	4548	21888225e7ad34f11b2429351738a7eb.exe	96
PID 4548 wrote to memory of 4808	4548	21888225e7ad34f11b2429351738a7eb.exe	98
PID 4548 wrote to memory of 4808	4548	21888225e7ad34f11b2429351738a7eb.exe	98
PID 4548 wrote to memory of 4808	4548	21888225e7ad34f11b2429351738a7eb.exe	98
PID 2648 wrote to memory of 2672	2648	wwjlcnwtx.exe	106
PID 2648 wrote to memory of 2672	2648	wwjlcnwtx.exe	106
PID 2648 wrote to memory of 2672	2648	wwjlcnwtx.exe	106
PID 2648 wrote to memory of 1048	2648	wwjlcnwtx.exe	107
PID 2648 wrote to memory of 1048	2648	wwjlcnwtx.exe	107
PID 2648 wrote to memory of 1048	2648	wwjlcnwtx.exe	107
PID 2672 wrote to memory of 2688	2672	wjsw.exe	109
PID 2672 wrote to memory of 2688	2672	wjsw.exe	109
PID 2672 wrote to memory of 2688	2672	wjsw.exe	109
PID 2672 wrote to memory of 4864	2672	wjsw.exe	111
PID 2672 wrote to memory of 4864	2672	wjsw.exe	111
PID 2672 wrote to memory of 4864	2672	wjsw.exe	111
PID 2688 wrote to memory of 4384	2688	wmayg.exe	113
PID 2688 wrote to memory of 4384	2688	wmayg.exe	113
PID 2688 wrote to memory of 4384	2688	wmayg.exe	113
PID 2688 wrote to memory of 3544	2688	wmayg.exe	114
PID 2688 wrote to memory of 3544	2688	wmayg.exe	114
PID 2688 wrote to memory of 3544	2688	wmayg.exe	114
PID 4384 wrote to memory of 4788	4384	wknwucewh.exe	118
PID 4384 wrote to memory of 4788	4384	wknwucewh.exe	118
PID 4384 wrote to memory of 4788	4384	wknwucewh.exe	118
PID 4384 wrote to memory of 1276	4384	wknwucewh.exe	120
PID 4384 wrote to memory of 1276	4384	wknwucewh.exe	120
PID 4384 wrote to memory of 1276	4384	wknwucewh.exe	120
PID 4788 wrote to memory of 1104	4788	wyhux.exe	121
PID 4788 wrote to memory of 1104	4788	wyhux.exe	121
PID 4788 wrote to memory of 1104	4788	wyhux.exe	121
PID 4788 wrote to memory of 2004	4788	wyhux.exe	122
PID 4788 wrote to memory of 2004	4788	wyhux.exe	122
PID 4788 wrote to memory of 2004	4788	wyhux.exe	122
PID 1104 wrote to memory of 2936	1104	wsng.exe	128
PID 1104 wrote to memory of 2936	1104	wsng.exe	128
PID 1104 wrote to memory of 2936	1104	wsng.exe	128
PID 1104 wrote to memory of 2340	1104	wsng.exe	129
PID 1104 wrote to memory of 2340	1104	wsng.exe	129
PID 1104 wrote to memory of 2340	1104	wsng.exe	129
PID 2936 wrote to memory of 4940	2936	wyvlgs.exe	131
PID 2936 wrote to memory of 4940	2936	wyvlgs.exe	131
PID 2936 wrote to memory of 4940	2936	wyvlgs.exe	131
PID 2936 wrote to memory of 2108	2936	wyvlgs.exe	133
PID 2936 wrote to memory of 2108	2936	wyvlgs.exe	133
PID 2936 wrote to memory of 2108	2936	wyvlgs.exe	133
PID 4940 wrote to memory of 3684	4940	wvxototfo.exe	136
PID 4940 wrote to memory of 3684	4940	wvxototfo.exe	136
PID 4940 wrote to memory of 3684	4940	wvxototfo.exe	136
PID 4940 wrote to memory of 4620	4940	wvxototfo.exe	137
PID 4940 wrote to memory of 4620	4940	wvxototfo.exe	137
PID 4940 wrote to memory of 4620	4940	wvxototfo.exe	137
PID 3684 wrote to memory of 2248	3684	wvkwqa.exe	140
PID 3684 wrote to memory of 2248	3684	wvkwqa.exe	140
PID 3684 wrote to memory of 2248	3684	wvkwqa.exe	140
PID 3684 wrote to memory of 1680	3684	wvkwqa.exe	141
PID 3684 wrote to memory of 1680	3684	wvkwqa.exe	141
PID 3684 wrote to memory of 1680	3684	wvkwqa.exe	141
PID 2248 wrote to memory of 2220	2248	wdpvrt.exe	145
PID 2248 wrote to memory of 2220	2248	wdpvrt.exe	145
PID 2248 wrote to memory of 2220	2248	wdpvrt.exe	145
PID 2248 wrote to memory of 4360	2248	wdpvrt.exe	146

C:\Users\Admin\AppData\Local\Temp\21888225e7ad34f11b2429351738a7eb.exe
"C:\Users\Admin\AppData\Local\Temp\21888225e7ad34f11b2429351738a7eb.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\wwjlcnwtx.exe
  "C:\Windows\system32\wwjlcnwtx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\wjsw.exe
    "C:\Windows\system32\wjsw.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\wmayg.exe
      "C:\Windows\system32\wmayg.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\wknwucewh.exe
        
        "C:\Windows\system32\wknwucewh.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Windows\SysWOW64\wyhux.exe
        
        "C:\Windows\system32\wyhux.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\wsng.exe
        
        "C:\Windows\system32\wsng.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\wyvlgs.exe
        
        "C:\Windows\system32\wyvlgs.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\wvxototfo.exe
        
        "C:\Windows\system32\wvxototfo.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\wvkwqa.exe
        
        "C:\Windows\system32\wvkwqa.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\wdpvrt.exe
        
        "C:\Windows\system32\wdpvrt.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\wkdil.exe
        
        "C:\Windows\system32\wkdil.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\wywpbp.exe
        
        "C:\Windows\system32\wywpbp.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\wgkou.exe
        
        "C:\Windows\system32\wgkou.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3372
        
        C:\Windows\SysWOW64\wxyrmcpkw.exe
        
        "C:\Windows\system32\wxyrmcpkw.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\wds.exe
        
        "C:\Windows\system32\wds.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2948
        
        C:\Windows\SysWOW64\wvahfwa.exe
        
        "C:\Windows\system32\wvahfwa.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2408
        
        C:\Windows\SysWOW64\whmsgjkra.exe
        
        "C:\Windows\system32\whmsgjkra.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1892
        
        C:\Windows\SysWOW64\wihadnsb.exe
        
        "C:\Windows\system32\wihadnsb.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whmsgjkra.exe"
        19⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvahfwa.exe"
        18⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wds.exe"
        17⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxyrmcpkw.exe"
        16⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgkou.exe"
        15⤵
        
        PID:392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1348
        15⤵
        Program crash
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wywpbp.exe"
        14⤵
        
        PID:348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkdil.exe"
        13⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdpvrt.exe"
        12⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvkwqa.exe"
        11⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 1448
        11⤵
        Program crash
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvxototfo.exe"
        10⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyvlgs.exe"
        9⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsng.exe"
        8⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyhux.exe"
        7⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1372
        7⤵
        Program crash
        
        PID:5092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1592
        7⤵
        Program crash
        
        PID:4376
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wknwucewh.exe"
        6⤵
        
        PID:1276
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmayg.exe"
        5⤵
        
        PID:3544
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjsw.exe"
      4⤵
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwjlcnwtx.exe"
    3⤵
    PID:1048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\21888225e7ad34f11b2429351738a7eb.exe"
  2⤵
  PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 880
  2⤵
  - Program crash
  PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4788 -ip 4788
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4788 -ip 4788
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3684 -ip 3684
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3372 -ip 3372
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wdpvrt.exe

Filesize
269KB

MD5
88e3051142713408ce5dd78c8287e613

SHA1
cc26c1c1b406b55b6f10b947039060480b3de9f9

SHA256
4eb7554ef0b4afe9aa3bed25128a86699277ab1100629f903667acec15083736

SHA512
c1613b01dec9d0333b2686b590d6d318e668f65d8e948faba08cfb0fd5dbaf0e3370b4c82a2876b8ad5792d3cff36f145073fecd5ac72edd2b80b8bffeb46231

Download Submit
C:\Windows\SysWOW64\wds.exe

Filesize
270KB

MD5
35a018ebbc9079132b4d70a3191cf0a0

SHA1
f7abe7b1af57cdb2b282469e1185af4c4f3af99b

SHA256
382d7acc8d47b4d410d4f538e55ddff98dca057b798409647b71616986b1143f

SHA512
5b71ada895d012aa8486df1d6809433b75c3bc1bc4d72f8215d6bc0fccfbe4e7748c0fa78fcd68ab1834da0c96a7a3012eb0e31170f5475b4cc9823497640283

Download Submit
C:\Windows\SysWOW64\wgkou.exe

Filesize
269KB

MD5
e0e25d07f77daa725830dd139404c5fb

SHA1
c5bdf944cf8191222807ab1168ebcda8e76e784c

SHA256
84fa940f4f28e10526a6d0e33289b268bdf87346b844022cf4b46939449abb79

SHA512
3416d535524cc4b748ab43af05a907e9ac82b719c2885f4f4bc86c70e15b99228222800a92afb9cc669eae14eb63fd701967ecd956f997047e13281d0faa033e

Download Submit
C:\Windows\SysWOW64\whmsgjkra.exe

Filesize
270KB

MD5
3c31b8d8804dc1f6c144966658fc00f2

SHA1
27655b709c98a5acae89b2232e76c140d749d61c

SHA256
13724b0999b03f2a38b98eabbbab24e56c2e2fe3e6e6bc2e2fd2fe33fef82464

SHA512
13ec76671db3c293125ef8e113a1649adc064382b2251abd78cbcd18681bd853b7a6c43f8b73d9cd66df78b7a4fbf33ed2057140abeb72f2a05aa4119e74a9c4

Download Submit
C:\Windows\SysWOW64\wihadnsb.exe

Filesize
270KB

MD5
bde7df3a5b6d90adc22e454e40234f0d

SHA1
645070ec8e7d4a01959d40481eec38d0d0d93763

SHA256
51015c8662cd1c652c5966b126e8c908a966f596d5fbd2c27fa830c4b7729c8c

SHA512
744df0df0b50abd19d98bb5a4c2d5ecc67d9b1cd24609b07b93fe41aa07b413ec63e507786f6d6246882b71fc816383f78a5dae33cc22f801658221b562ef51d

Download Submit
C:\Windows\SysWOW64\wjsw.exe

Filesize
269KB

MD5
9efbdc9060d8115875ae33f0c3f6f8c7

SHA1
7864d21f19986c4e62182c87508eca0f03357e58

SHA256
040cca674dbc9ef914f15952fcbf71a5c4e9bc3f32fb7580e599f72e3ac1888d

SHA512
049b1d1a839c67d39cf6b44f3e791c8816a55cb740a72f229caa611adb0756072b3728b117bb7df713e5e010bcd5bc798d1707c7cdedddfd7e308fa1a05f5707

Download Submit
C:\Windows\SysWOW64\wkdil.exe

Filesize
269KB

MD5
5b10561f7b37b45e91f12ac719302d4f

SHA1
b9495c5481e4d6f6927c41fe6f804872665e6f64

SHA256
ba53f36c5316208d053cc08b611888f10ffdd041c946c9a26812c6eb6552e4d5

SHA512
f4a2ecd70630718a473f3677a82ba8b3333322de4cf566b17e1271ef106e080d5340c7fee11b0ef9a31ec3bf31024aa17bec655caf4dc2424e81fa11dada1398

Download Submit
C:\Windows\SysWOW64\wknwucewh.exe

Filesize
269KB

MD5
d369d264bc36c8398b0e11c08bbc1f68

SHA1
319565fe9107b383b108d66b876c4ed486def2c7

SHA256
6052bb20af6975fd32770ab2a47c81c6e1f479e944a49e3b8235d0f8cf88b169

SHA512
e02bc9ef6469b283aa05889f21e413b23ce8ad3ca5813a953e2b83901b655fba3eeef62c0f7b427aebe14f56424b66e17726e9b2177523e94ad38b6e024510f2

Download Submit
C:\Windows\SysWOW64\wmayg.exe

Filesize
269KB

MD5
f5cdffc9f7936bd31fe8127b91a791f2

SHA1
7afb3c2e829ce374e589ebcba8e34ac73a49b9e7

SHA256
f011279f25d57aa9544fa23925ab40ee675b90b15d099c4e3567131c1cc45326

SHA512
5cb3c2a15b1afc1052df459a64c5c0e5166726b15f2299c2e15e13bfed38197239e2c3bc4f243aa0433aed185c032fb4e08a58c5fd7b5c0062de531ee8080098

Download Submit
C:\Windows\SysWOW64\wsng.exe

Filesize
269KB

MD5
88a27da5e9e4ab9abbcbbf34a2aca903

SHA1
8dbf4fc038f4cd50ad8f9a36bc9ff7691d45c34e

SHA256
9162d824e1b9b292f260217b3d38a015e84f232b812290b0ef42e15dc3c62d01

SHA512
1bed441a0e5235154cc79a42ab67750f833e6f63786ced616c03e8e200fe839dfd7ceb7231a566662a46811011721d078e46f256f50c26268f716cc1a2df8668

Download Submit
C:\Windows\SysWOW64\wvahfwa.exe

Filesize
270KB

MD5
2e07421b528c5f6f080ac23de54f6885

SHA1
7f252858e46c3c865eb9c44c70012b4e047a3c94

SHA256
658089945e814f48848025446f6c79f69d212884c6cb610d556701c494c24cd0

SHA512
4fac7e0e0987968d38a72ead8cd8b372d69e81db8a8118b4ec8c226f1e8cb3285cd0bb806fad0371052111517e7e132e8e8a176793be98196b49fcd94c6584a6

Download Submit
C:\Windows\SysWOW64\wvkwqa.exe

Filesize
269KB

MD5
c1e185a9dc497ffac7fb4f3e4e01e14a

SHA1
2a3eeeb0dd8dddad39a8fc62d603af9bb2733cba

SHA256
71008eb8561d7c3fbae358fcc40c791143ffc05f7ef2c8a62cd0fb4e212efa28

SHA512
5d04a37eb34e716aef498bad885b3591335093f8af91cd053c6598ed1a91894becc132a20b35043909c616c13dcb2b9faf2667238817e036e47035fcf81c8b7b

Download Submit
C:\Windows\SysWOW64\wvxototfo.exe

Filesize
269KB

MD5
0ed6cadd65ae791bf496cf3833a8b654

SHA1
7a2069b8c28947e82ca63cba06649e1b818ed447

SHA256
2ecc28bd75cd026c0f747ae689e5befdbf0ade8f131211f62f749db91308dbe9

SHA512
8e235ea2db7adf7cc9678e0ad49c4a5d362b832f3e7f9a09aeedc5c5440b087098dddcb72dc3b96f67c06c7b380d9001f85573c8e557cfb7aa6c939201e9a99d

Download Submit
C:\Windows\SysWOW64\wwjlcnwtx.exe

Filesize
269KB

MD5
ded9a48fb8c3196726992e2c514ba84a

SHA1
a510869834b037c6a98876d5715020e968d32f85

SHA256
232f0c790bc4fbec05aae5967be33105265b5515ee748e4b4c0474c32e56616f

SHA512
49fbcbb24ec9f91b6e034a94c8403cc6e9c0d079c3a4039733966ea0c20ccf671cd5d4606cdba56a9f3f8698ea65df9437e60b777af4bb52f23901b40d41076d

Download Submit
C:\Windows\SysWOW64\wxyrmcpkw.exe

Filesize
269KB

MD5
b4ac322a741323365e5f38ff366d2299

SHA1
6e32e1c1f5767cf31b4f827d4b9e60839a1dc8ce

SHA256
e7fa4eaf3c3e9ab40b694dd1afda1f5711ecebfca3f098cc7333e9e0d3553080

SHA512
733ecf5dd23d411b6e3452f5e3496ddb418c2aa5017f74d35f28b91a51dfc3ea6a6f2fa40988e6104dc8701962b673f0e3881bd0c52f8939ba0dad57ed21a5b7

Download Submit
C:\Windows\SysWOW64\wyhux.exe

Filesize
269KB

MD5
fb9b9e0512002b14fe7980f7d8c42d89

SHA1
476e42a7927cfe82e274e3ebeac2c3ab3daed13a

SHA256
20b86872fdd6137dd2a7875a7c91024b4ffc8e610a651dacb16fac335a8a50b3

SHA512
f74e26d5d0c3acb84664daa89a7f2d2349e4d60c75dfd62e060d19e5dff277ebe63b6b741dfd7edea5b6c353380c7165943324000f095753e26d67aa4789c538

Download Submit
C:\Windows\SysWOW64\wyvlgs.exe

Filesize
269KB

MD5
6c786152f26ec1165ad8e0fe2c871742

SHA1
ae598927215d6cab99839d04592de77f9fd86865

SHA256
9e5e0a0a443a106342e805b7cbb6fda19ec8abfdea1f010706990bf2d2f8582a

SHA512
e8b2295072e7af4074e1c328741ae9f8ec531a1dfb6a578192890229d6940a160d2caa641aca5974b3fef801f0e9aa1513d03565d04d681b86fc08ff1ed18ebf

Download Submit
C:\Windows\SysWOW64\wywpbp.exe

Filesize
269KB

MD5
0fbffdaa419c936904f1dc2f071da401

SHA1
b9f5fc2f2aaca87b4d4e5594fe898a74a7e82ddb

SHA256
62a4b44d6deb6c221e3ec7b345d1be4030fcd2b50ca1f856fab39a38705f4e25

SHA512
864bdb5de4f03e0ec2fc76727fdbd69700fadd698fc814f0db62b01826c0ac030895d628869ce597bd254a630f867e6b776b621c11abbcd7b4616fc2cdd70454

Download Submit
memory/8-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1104-73-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1892-189-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2220-124-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2248-113-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2248-103-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2408-167-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2408-179-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2648-21-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2672-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2688-41-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2936-83-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2948-166-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3372-169-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3684-126-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4384-52-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4548-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4548-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4656-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4788-51-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4788-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4940-93-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download