0fd861c2493fcbc519087d9501d26a9d4305f5779846f34a91be3a7b89b53cec

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4976a43ba0af6e817cfcad4e7b530f52.exe
Size 80KB
Sample240107-x12hsaccdn
SHA256 0fd861c2493fcbc519087d9501d26a9d4305f5779846f34a91be3a7b89b53cec
MD5 4976a43ba0af6e817cfcad4e7b530f52
SHA1 f73c23b35c7fb1fda379297a6dc00153431c1087
SHA512 894f9177bca9d03a55b5164e5d560d75cb7f6550b8a94d8c257c07c7d4e54b5eae08408a953df383f2d8be946e22b8cb0535412aaddcf4a83d3cbc0e9dd99d20
SSDEEP 1536:RpiL2qmMRRlfgEyS3BdVV7nJu+QHgaRhdsRJIj:Dqm8gEXxdf7nJTQHgajiIj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe"	userinit.exe

Executes dropped EXE 64 IoCs

pid	Process
840	userinit.exe
1592	system.exe
4908	system.exe
932	system.exe
4944	system.exe
1920	system.exe
716	system.exe
844	system.exe
1468	system.exe
2412	system.exe
4820	system.exe
2368	system.exe
4688	system.exe
4076	system.exe
4156	system.exe
1240	system.exe
4544	system.exe
1592	system.exe
3192	system.exe
1812	system.exe
3488	system.exe
1920	system.exe
2552	system.exe
1788	system.exe
4704	system.exe
3556	system.exe
4572	system.exe
4624	system.exe
2184	system.exe
4556	system.exe
3152	system.exe
4468	system.exe
676	system.exe
1616	system.exe
2340	system.exe
4036	system.exe
548	system.exe
2040	system.exe
1920	system.exe
1608	system.exe
1672	system.exe
4736	system.exe
3152	system.exe
4468	system.exe
4960	system.exe
4440	system.exe
3400	system.exe
1152	system.exe
1288	system.exe
4576	system.exe
1920	system.exe
3176	system.exe
3544	system.exe
1672	system.exe
3204	system.exe
2096	system.exe
3780	system.exe
3236	system.exe
4552	system.exe
3984	system.exe
1616	system.exe
4104	system.exe
4684	system.exe
3488	system.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system.exe	userinit.exe
File created	C:\Windows\SysWOW64\system.exe	userinit.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\userinit.exe	4976a43ba0af6e817cfcad4e7b530f52.exe
File created	C:\Windows\kdcoms.dll	userinit.exe
File created	C:\Windows\userinit.exe	4976a43ba0af6e817cfcad4e7b530f52.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	4976a43ba0af6e817cfcad4e7b530f52.exe
4960	4976a43ba0af6e817cfcad4e7b530f52.exe
840	userinit.exe
840	userinit.exe
840	userinit.exe
840	userinit.exe
1592	system.exe
1592	system.exe
840	userinit.exe
840	userinit.exe
4908	system.exe
4908	system.exe
840	userinit.exe
840	userinit.exe
932	system.exe
932	system.exe
840	userinit.exe
840	userinit.exe
4944	system.exe
4944	system.exe
840	userinit.exe
840	userinit.exe
1920	system.exe
1920	system.exe
840	userinit.exe
840	userinit.exe
716	system.exe
716	system.exe
840	userinit.exe
840	userinit.exe
844	system.exe
844	system.exe
840	userinit.exe
840	userinit.exe
1468	system.exe
1468	system.exe
840	userinit.exe
840	userinit.exe
2412	system.exe
2412	system.exe
840	userinit.exe
840	userinit.exe
4820	system.exe
4820	system.exe
840	userinit.exe
840	userinit.exe
2368	system.exe
2368	system.exe
840	userinit.exe
840	userinit.exe
4688	system.exe
4688	system.exe
840	userinit.exe
840	userinit.exe
4076	system.exe
4076	system.exe
840	userinit.exe
840	userinit.exe
4156	system.exe
4156	system.exe
840	userinit.exe
840	userinit.exe
1240	system.exe
1240	system.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	userinit.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4960	4976a43ba0af6e817cfcad4e7b530f52.exe
4960	4976a43ba0af6e817cfcad4e7b530f52.exe
840	userinit.exe
840	userinit.exe
1592	system.exe
1592	system.exe
4908	system.exe
4908	system.exe
932	system.exe
932	system.exe
4944	system.exe
4944	system.exe
1920	system.exe
1920	system.exe
716	system.exe
716	system.exe
844	system.exe
844	system.exe
1468	system.exe
1468	system.exe
2412	system.exe
2412	system.exe
4820	system.exe
4820	system.exe
2368	system.exe
2368	system.exe
4688	system.exe
4688	system.exe
4076	system.exe
4076	system.exe
4156	system.exe
4156	system.exe
1240	system.exe
1240	system.exe
4544	system.exe
4544	system.exe
1592	system.exe
1592	system.exe
3192	system.exe
3192	system.exe
1812	system.exe
1812	system.exe
3488	system.exe
3488	system.exe
1920	system.exe
1920	system.exe
2552	system.exe
2552	system.exe
1788	system.exe
1788	system.exe
4704	system.exe
4704	system.exe
3556	system.exe
3556	system.exe
4572	system.exe
4572	system.exe
4624	system.exe
4624	system.exe
2184	system.exe
2184	system.exe
4556	system.exe
4556	system.exe
3152	system.exe
3152	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 840	4960	4976a43ba0af6e817cfcad4e7b530f52.exe	88
PID 4960 wrote to memory of 840	4960	4976a43ba0af6e817cfcad4e7b530f52.exe	88
PID 4960 wrote to memory of 840	4960	4976a43ba0af6e817cfcad4e7b530f52.exe	88
PID 840 wrote to memory of 1592	840	userinit.exe	92
PID 840 wrote to memory of 1592	840	userinit.exe	92
PID 840 wrote to memory of 1592	840	userinit.exe	92
PID 840 wrote to memory of 4908	840	userinit.exe	93
PID 840 wrote to memory of 4908	840	userinit.exe	93
PID 840 wrote to memory of 4908	840	userinit.exe	93
PID 840 wrote to memory of 932	840	userinit.exe	94
PID 840 wrote to memory of 932	840	userinit.exe	94
PID 840 wrote to memory of 932	840	userinit.exe	94
PID 840 wrote to memory of 4944	840	userinit.exe	95
PID 840 wrote to memory of 4944	840	userinit.exe	95
PID 840 wrote to memory of 4944	840	userinit.exe	95
PID 840 wrote to memory of 1920	840	userinit.exe	96
PID 840 wrote to memory of 1920	840	userinit.exe	96
PID 840 wrote to memory of 1920	840	userinit.exe	96
PID 840 wrote to memory of 716	840	userinit.exe	97
PID 840 wrote to memory of 716	840	userinit.exe	97
PID 840 wrote to memory of 716	840	userinit.exe	97
PID 840 wrote to memory of 844	840	userinit.exe	98
PID 840 wrote to memory of 844	840	userinit.exe	98
PID 840 wrote to memory of 844	840	userinit.exe	98
PID 840 wrote to memory of 1468	840	userinit.exe	99
PID 840 wrote to memory of 1468	840	userinit.exe	99
PID 840 wrote to memory of 1468	840	userinit.exe	99
PID 840 wrote to memory of 2412	840	userinit.exe	100
PID 840 wrote to memory of 2412	840	userinit.exe	100
PID 840 wrote to memory of 2412	840	userinit.exe	100
PID 840 wrote to memory of 4820	840	userinit.exe	103
PID 840 wrote to memory of 4820	840	userinit.exe	103
PID 840 wrote to memory of 4820	840	userinit.exe	103
PID 840 wrote to memory of 2368	840	userinit.exe	106
PID 840 wrote to memory of 2368	840	userinit.exe	106
PID 840 wrote to memory of 2368	840	userinit.exe	106
PID 840 wrote to memory of 4688	840	userinit.exe	107
PID 840 wrote to memory of 4688	840	userinit.exe	107
PID 840 wrote to memory of 4688	840	userinit.exe	107
PID 840 wrote to memory of 4076	840	userinit.exe	108
PID 840 wrote to memory of 4076	840	userinit.exe	108
PID 840 wrote to memory of 4076	840	userinit.exe	108
PID 840 wrote to memory of 4156	840	userinit.exe	110
PID 840 wrote to memory of 4156	840	userinit.exe	110
PID 840 wrote to memory of 4156	840	userinit.exe	110
PID 840 wrote to memory of 1240	840	userinit.exe	111
PID 840 wrote to memory of 1240	840	userinit.exe	111
PID 840 wrote to memory of 1240	840	userinit.exe	111
PID 840 wrote to memory of 4544	840	userinit.exe	112
PID 840 wrote to memory of 4544	840	userinit.exe	112
PID 840 wrote to memory of 4544	840	userinit.exe	112
PID 840 wrote to memory of 1592	840	userinit.exe	115
PID 840 wrote to memory of 1592	840	userinit.exe	115
PID 840 wrote to memory of 1592	840	userinit.exe	115
PID 840 wrote to memory of 3192	840	userinit.exe	116
PID 840 wrote to memory of 3192	840	userinit.exe	116
PID 840 wrote to memory of 3192	840	userinit.exe	116
PID 840 wrote to memory of 1812	840	userinit.exe	117
PID 840 wrote to memory of 1812	840	userinit.exe	117
PID 840 wrote to memory of 1812	840	userinit.exe	117
PID 840 wrote to memory of 3488	840	userinit.exe	118
PID 840 wrote to memory of 3488	840	userinit.exe	118
PID 840 wrote to memory of 3488	840	userinit.exe	118
PID 840 wrote to memory of 1920	840	userinit.exe	119

C:\Users\Admin\AppData\Local\Temp\4976a43ba0af6e817cfcad4e7b530f52.exe
"C:\Users\Admin\AppData\Local\Temp\4976a43ba0af6e817cfcad4e7b530f52.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\userinit.exe
  C:\Windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1592
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4908
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:932
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4944
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1920
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:716
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:844
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1468
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2412
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4820
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2368
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4688
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4076
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4156
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1240
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4544
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3192
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3488
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2552
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1788
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4704
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4572
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3152
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:676
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2340
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4036
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:548
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2040
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1608
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4736
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3152
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4468
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4960
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4440
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3400
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1288
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4576
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1920
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3176
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3544
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1672
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3204
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3780
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3236
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4552
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3984
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4104
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4684
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3488
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4484
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:876
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:612
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:864
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:452
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:868
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:220
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:540
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 64KB
SHA256 4a1024bf0ff9ef9525c92b485a9cc58b4c4397d0c2b2595b27c42357e98708cd
MD5 44bc347963c70d8b780beace248d8fb5
SHA1 a62b209a31253de69556b630c5a7d11e30f829c9
SHA512 fa869d378ebde649c13adfe9257bb3cf54cc82aec1d68b3b4116bee7a6ce9604cb91e0bd33856d78eb30f5a3aa536cebe1b12f002209b07c1b14ddb1616fb31b
SSDEEP 768:eepPXErL2qmVDWR4glfgOLc3DSbrBhb7h6NM4OnouJNIcZQHgaRxi:RpiL2qmMRRlfgEyS3BdVV7nJu+QHgaR0
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 12KB
SHA256 bae8fb0c42def3817754a4ddc55ae15be22bbd9eaedca9f33b21d317a8a404bf
MD5 1768240692efc28776b13a0fd95431a1
SHA1 1a04353d3119d510000c51cc50b7db41541840c3
SHA512 7cbed043791658c1fa223faab95f769923e99c5f89425f62b3c9b75c25b496505c124631b13bab5d79a6b05a88ae5ebe912a7646a785c1239df0479c7431673a
SSDEEP 192:e0LN+cSSdRn7KTaKneQXlplJmTrtsbABz7nrYDhztiiapSdcWCEm+gVMpzlcy:eepP7KeErmds2TehsiapSSWR4Khlcy
MD5 SHA1 SHA512 SSDEEP

Submit Download

userinit.exe

Path C:\Windows\userinit.exe
Size 80KB
SHA256 0fd861c2493fcbc519087d9501d26a9d4305f5779846f34a91be3a7b89b53cec
MD5 4976a43ba0af6e817cfcad4e7b530f52
SHA1 f73c23b35c7fb1fda379297a6dc00153431c1087
SHA512 894f9177bca9d03a55b5164e5d560d75cb7f6550b8a94d8c257c07c7d4e54b5eae08408a953df383f2d8be946e22b8cb0535412aaddcf4a83d3cbc0e9dd99d20
SSDEEP 1536:RpiL2qmMRRlfgEyS3BdVV7nJu+QHgaRhdsRJIj:Dqm8gEXxdf7nJTQHgajiIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-235-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/676-212-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/676-208-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/716-59-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/716-55-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/840-80-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/840-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/840-12-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/844-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/844-61-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/876-422-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/932-42-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/932-38-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1152-290-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1152-294-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1240-112-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1288-300-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1468-72-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1468-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1468-68-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1592-29-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1592-24-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1592-123-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1592-25-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/1616-367-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1616-214-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1616-218-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1672-326-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1672-257-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1788-158-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1812-136-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1812-131-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1812-130-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1880-390-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1880-395-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-415-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-148-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-311-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-144-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-307-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-53-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-49-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1920-246-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1920-242-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2040-240-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2096-338-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2096-334-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2184-187-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2184-183-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2340-224-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2340-220-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2348-416-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2348-421-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2368-87-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2368-91-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2412-74-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2412-78-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2552-153-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3152-200-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3152-267-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3152-196-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3176-316-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3192-453-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3192-128-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3204-332-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3204-328-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3236-348-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3312-459-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3400-284-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3400-288-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3488-378-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/3488-383-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3488-138-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3488-142-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3500-384-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3500-389-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3544-321-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3556-168-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3780-343-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3984-357-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4000-431-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4036-230-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4036-226-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4076-102-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4104-373-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4156-107-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4188-438-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4412-432-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4412-437-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4440-282-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4468-206-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4468-202-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4468-272-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4484-396-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4484-401-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4544-114-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4544-118-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4552-352-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4556-191-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4556-194-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4572-170-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4572-171-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4572-175-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4624-177-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4624-181-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4688-93-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4688-97-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4704-163-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4736-262-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4820-81-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4820-85-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4908-31-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4908-32-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4908-36-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4944-47-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4960-17-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4960-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/4960-277-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4960-443-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/4960-448-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4960-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download