962732f246f5fe770084bb07359944f589764c1d98006d96a01fc0a775d5704d

Analysis

max time kernel
172s
max time network
189s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57efcc0242fee92bddbb8f9c25d23481.exe
Size

265KB
MD5

57efcc0242fee92bddbb8f9c25d23481
SHA1

118878852909d6cb317ee5c39113750bdd56dc4d
SHA256

962732f246f5fe770084bb07359944f589764c1d98006d96a01fc0a775d5704d
SHA512

f0cf55853941e2391a21561e7def1eaaa78b6f6f191a5c7138175064b864d6d2e62cb6001370493c1db16483f068480aef38de89e26fee1e8292f6c05ea47018
SSDEEP

3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVpuJOm:ZY7xh6SZI4z7FSVpuJb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2532	cmd.exe

Executes dropped EXE 38 IoCs

pid	Process
2568	woa.exe
1124	wpmjafeo.exe
1284	wysif.exe
3032	wukbxrfm.exe
1164	wuq.exe
1700	wrxqrul.exe
2640	wwvdgerfk.exe
2164	wctqupx.exe
1664	woumwj.exe
2536	wugqds.exe
1408	wsbnhs.exe
2864	wxybvcg.exe
1748	wkbmuq.exe
2080	wvctp.exe
1020	whrfdgxb.exe
2552	wdnfi.exe
2792	wtu.exe
1628	wylbfht.exe
652	wkwaceu.exe
1696	waommqhp.exe
1852	wwblto.exe
2092	wppckcnh.exe
1800	wmvyddtc.exe
2288	wreao.exe
2808	wgupnvbqr.exe
2912	wkknvfbe.exe
944	wuoliisny.exe
1036	wcdlwfw.exe
664	wjxbj.exe
2516	wnuoxx.exe
1624	wxfuij.exe
1480	wxumibng.exe
2212	wgclka.exe
3004	wtqwsfl.exe
2368	wxaqyhk.exe
1412	wagawdkj.exe
1436	wbcngmsd.exe
1036	wfncwwg.exe

Loads dropped DLL 64 IoCs

pid	Process
2792	57efcc0242fee92bddbb8f9c25d23481.exe
2792	57efcc0242fee92bddbb8f9c25d23481.exe
2792	57efcc0242fee92bddbb8f9c25d23481.exe
2792	57efcc0242fee92bddbb8f9c25d23481.exe
2568	woa.exe
2568	woa.exe
2568	woa.exe
2568	woa.exe
1124	wpmjafeo.exe
1124	wpmjafeo.exe
1124	wpmjafeo.exe
1124	wpmjafeo.exe
1284	wysif.exe
1284	wysif.exe
1284	wysif.exe
1284	wysif.exe
3032	wukbxrfm.exe
3032	wukbxrfm.exe
3032	wukbxrfm.exe
3032	wukbxrfm.exe
1164	wuq.exe
1164	wuq.exe
1164	wuq.exe
1164	wuq.exe
1700	wrxqrul.exe
1700	wrxqrul.exe
1700	wrxqrul.exe
1700	wrxqrul.exe
2640	wwvdgerfk.exe
2640	wwvdgerfk.exe
2640	wwvdgerfk.exe
2640	wwvdgerfk.exe
2164	wctqupx.exe
2164	wctqupx.exe
2164	wctqupx.exe
2164	wctqupx.exe
1664	woumwj.exe
1664	woumwj.exe
1664	woumwj.exe
1664	woumwj.exe
2536	wugqds.exe
2536	wugqds.exe
2536	wugqds.exe
2536	wugqds.exe
1408	wsbnhs.exe
1408	wsbnhs.exe
1408	wsbnhs.exe
1408	wsbnhs.exe
2864	wxybvcg.exe
2864	wxybvcg.exe
2864	wxybvcg.exe
2864	wxybvcg.exe
1748	wkbmuq.exe
1748	wkbmuq.exe
1748	wkbmuq.exe
1748	wkbmuq.exe
2080	wvctp.exe
2080	wvctp.exe
2080	wvctp.exe
2080	wvctp.exe
1020	whrfdgxb.exe
1020	whrfdgxb.exe
1020	whrfdgxb.exe
1020	whrfdgxb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wugqds.exe	woumwj.exe
File opened for modification	C:\Windows\SysWOW64\wsbnhs.exe	wugqds.exe
File created	C:\Windows\SysWOW64\wkbmuq.exe	wxybvcg.exe
File opened for modification	C:\Windows\SysWOW64\whrfdgxb.exe	wvctp.exe
File created	C:\Windows\SysWOW64\wtqwsfl.exe	wgclka.exe
File created	C:\Windows\SysWOW64\wfncwwg.exe	wbcngmsd.exe
File created	C:\Windows\SysWOW64\wuq.exe	wukbxrfm.exe
File created	C:\Windows\SysWOW64\wppckcnh.exe	wwblto.exe
File created	C:\Windows\SysWOW64\wgupnvbqr.exe	wreao.exe
File created	C:\Windows\SysWOW64\wbcngmsd.exe	wagawdkj.exe
File opened for modification	C:\Windows\SysWOW64\woumwj.exe	wctqupx.exe
File opened for modification	C:\Windows\SysWOW64\waommqhp.exe	wkwaceu.exe
File created	C:\Windows\SysWOW64\wwblto.exe	waommqhp.exe
File opened for modification	C:\Windows\SysWOW64\wtqwsfl.exe	wgclka.exe
File opened for modification	C:\Windows\SysWOW64\wxaqyhk.exe	wtqwsfl.exe
File opened for modification	C:\Windows\SysWOW64\wpmjafeo.exe	woa.exe
File opened for modification	C:\Windows\SysWOW64\wuq.exe	wukbxrfm.exe
File created	C:\Windows\SysWOW64\wxybvcg.exe	wsbnhs.exe
File opened for modification	C:\Windows\SysWOW64\wdnfi.exe	whrfdgxb.exe
File created	C:\Windows\SysWOW64\wxfuij.exe	wnuoxx.exe
File created	C:\Windows\SysWOW64\wxumibng.exe	wxfuij.exe
File opened for modification	C:\Windows\SysWOW64\wppckcnh.exe	wwblto.exe
File created	C:\Windows\SysWOW64\wmvyddtc.exe	wppckcnh.exe
File opened for modification	C:\Windows\SysWOW64\wmvyddtc.exe	wppckcnh.exe
File opened for modification	C:\Windows\SysWOW64\wnuoxx.exe	wjxbj.exe
File opened for modification	C:\Windows\SysWOW64\wagawdkj.exe	wxaqyhk.exe
File opened for modification	C:\Windows\SysWOW64\wvnnfja.exe	wfncwwg.exe
File created	C:\Windows\SysWOW64\wukbxrfm.exe	wysif.exe
File opened for modification	C:\Windows\SysWOW64\wugqds.exe	woumwj.exe
File opened for modification	C:\Windows\SysWOW64\wtu.exe	wdnfi.exe
File opened for modification	C:\Windows\SysWOW64\wylbfht.exe	wtu.exe
File opened for modification	C:\Windows\SysWOW64\wuoliisny.exe	wkknvfbe.exe
File opened for modification	C:\Windows\SysWOW64\wxumibng.exe	wxfuij.exe
File opened for modification	C:\Windows\SysWOW64\wrxqrul.exe	wuq.exe
File opened for modification	C:\Windows\SysWOW64\wkbmuq.exe	wxybvcg.exe
File created	C:\Windows\SysWOW64\wkknvfbe.exe	wgupnvbqr.exe
File opened for modification	C:\Windows\SysWOW64\woa.exe	57efcc0242fee92bddbb8f9c25d23481.exe
File created	C:\Windows\SysWOW64\wysif.exe	wpmjafeo.exe
File created	C:\Windows\SysWOW64\wctqupx.exe	wwvdgerfk.exe
File created	C:\Windows\SysWOW64\woumwj.exe	wctqupx.exe
File created	C:\Windows\SysWOW64\wvctp.exe	wkbmuq.exe
File created	C:\Windows\SysWOW64\waommqhp.exe	wkwaceu.exe
File created	C:\Windows\SysWOW64\wxaqyhk.exe	wtqwsfl.exe
File opened for modification	C:\Windows\SysWOW64\wgclka.exe	wxumibng.exe
File created	C:\Windows\SysWOW64\wrxqrul.exe	wuq.exe
File created	C:\Windows\SysWOW64\wwvdgerfk.exe	wrxqrul.exe
File opened for modification	C:\Windows\SysWOW64\wwvdgerfk.exe	wrxqrul.exe
File created	C:\Windows\SysWOW64\wsbnhs.exe	wugqds.exe
File opened for modification	C:\Windows\SysWOW64\wkwaceu.exe	wylbfht.exe
File opened for modification	C:\Windows\SysWOW64\wwblto.exe	waommqhp.exe
File opened for modification	C:\Windows\SysWOW64\wkknvfbe.exe	wgupnvbqr.exe
File created	C:\Windows\SysWOW64\wagawdkj.exe	wxaqyhk.exe
File opened for modification	C:\Windows\SysWOW64\wvctp.exe	wkbmuq.exe
File created	C:\Windows\SysWOW64\wtu.exe	wdnfi.exe
File created	C:\Windows\SysWOW64\wylbfht.exe	wtu.exe
File opened for modification	C:\Windows\SysWOW64\wcdlwfw.exe	wuoliisny.exe
File created	C:\Windows\SysWOW64\wnuoxx.exe	wjxbj.exe
File opened for modification	C:\Windows\SysWOW64\wxfuij.exe	wnuoxx.exe
File created	C:\Windows\SysWOW64\wdnfi.exe	whrfdgxb.exe
File created	C:\Windows\SysWOW64\wuoliisny.exe	wkknvfbe.exe
File opened for modification	C:\Windows\SysWOW64\wjxbj.exe	wcdlwfw.exe
File opened for modification	C:\Windows\SysWOW64\wbcngmsd.exe	wagawdkj.exe
File created	C:\Windows\SysWOW64\wvnnfja.exe	wfncwwg.exe
File created	C:\Windows\SysWOW64\woa.exe	57efcc0242fee92bddbb8f9c25d23481.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	1480	WerFault.exe	129

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2568	2792	57efcc0242fee92bddbb8f9c25d23481.exe	30
PID 2792 wrote to memory of 2568	2792	57efcc0242fee92bddbb8f9c25d23481.exe	30
PID 2792 wrote to memory of 2568	2792	57efcc0242fee92bddbb8f9c25d23481.exe	30
PID 2792 wrote to memory of 2568	2792	57efcc0242fee92bddbb8f9c25d23481.exe	30
PID 2792 wrote to memory of 2532	2792	57efcc0242fee92bddbb8f9c25d23481.exe	32
PID 2792 wrote to memory of 2532	2792	57efcc0242fee92bddbb8f9c25d23481.exe	32
PID 2792 wrote to memory of 2532	2792	57efcc0242fee92bddbb8f9c25d23481.exe	32
PID 2792 wrote to memory of 2532	2792	57efcc0242fee92bddbb8f9c25d23481.exe	32
PID 2568 wrote to memory of 1124	2568	woa.exe	34
PID 2568 wrote to memory of 1124	2568	woa.exe	34
PID 2568 wrote to memory of 1124	2568	woa.exe	34
PID 2568 wrote to memory of 1124	2568	woa.exe	34
PID 2568 wrote to memory of 1416	2568	woa.exe	36
PID 2568 wrote to memory of 1416	2568	woa.exe	36
PID 2568 wrote to memory of 1416	2568	woa.exe	36
PID 2568 wrote to memory of 1416	2568	woa.exe	36
PID 1124 wrote to memory of 1284	1124	wpmjafeo.exe	37
PID 1124 wrote to memory of 1284	1124	wpmjafeo.exe	37
PID 1124 wrote to memory of 1284	1124	wpmjafeo.exe	37
PID 1124 wrote to memory of 1284	1124	wpmjafeo.exe	37
PID 1124 wrote to memory of 2472	1124	wpmjafeo.exe	38
PID 1124 wrote to memory of 2472	1124	wpmjafeo.exe	38
PID 1124 wrote to memory of 2472	1124	wpmjafeo.exe	38
PID 1124 wrote to memory of 2472	1124	wpmjafeo.exe	38
PID 1284 wrote to memory of 3032	1284	wysif.exe	40
PID 1284 wrote to memory of 3032	1284	wysif.exe	40
PID 1284 wrote to memory of 3032	1284	wysif.exe	40
PID 1284 wrote to memory of 3032	1284	wysif.exe	40
PID 1284 wrote to memory of 1852	1284	wysif.exe	41
PID 1284 wrote to memory of 1852	1284	wysif.exe	41
PID 1284 wrote to memory of 1852	1284	wysif.exe	41
PID 1284 wrote to memory of 1852	1284	wysif.exe	41
PID 3032 wrote to memory of 1164	3032	wukbxrfm.exe	44
PID 3032 wrote to memory of 1164	3032	wukbxrfm.exe	44
PID 3032 wrote to memory of 1164	3032	wukbxrfm.exe	44
PID 3032 wrote to memory of 1164	3032	wukbxrfm.exe	44
PID 3032 wrote to memory of 1480	3032	wukbxrfm.exe	45
PID 3032 wrote to memory of 1480	3032	wukbxrfm.exe	45
PID 3032 wrote to memory of 1480	3032	wukbxrfm.exe	45
PID 3032 wrote to memory of 1480	3032	wukbxrfm.exe	45
PID 1164 wrote to memory of 1700	1164	wuq.exe	47
PID 1164 wrote to memory of 1700	1164	wuq.exe	47
PID 1164 wrote to memory of 1700	1164	wuq.exe	47
PID 1164 wrote to memory of 1700	1164	wuq.exe	47
PID 1164 wrote to memory of 2508	1164	wuq.exe	48
PID 1164 wrote to memory of 2508	1164	wuq.exe	48
PID 1164 wrote to memory of 2508	1164	wuq.exe	48
PID 1164 wrote to memory of 2508	1164	wuq.exe	48
PID 1700 wrote to memory of 2640	1700	wrxqrul.exe	50
PID 1700 wrote to memory of 2640	1700	wrxqrul.exe	50
PID 1700 wrote to memory of 2640	1700	wrxqrul.exe	50
PID 1700 wrote to memory of 2640	1700	wrxqrul.exe	50
PID 1700 wrote to memory of 2028	1700	wrxqrul.exe	51
PID 1700 wrote to memory of 2028	1700	wrxqrul.exe	51
PID 1700 wrote to memory of 2028	1700	wrxqrul.exe	51
PID 1700 wrote to memory of 2028	1700	wrxqrul.exe	51
PID 2640 wrote to memory of 2164	2640	wwvdgerfk.exe	54
PID 2640 wrote to memory of 2164	2640	wwvdgerfk.exe	54
PID 2640 wrote to memory of 2164	2640	wwvdgerfk.exe	54
PID 2640 wrote to memory of 2164	2640	wwvdgerfk.exe	54
PID 2640 wrote to memory of 2800	2640	wwvdgerfk.exe	55
PID 2640 wrote to memory of 2800	2640	wwvdgerfk.exe	55
PID 2640 wrote to memory of 2800	2640	wwvdgerfk.exe	55
PID 2640 wrote to memory of 2800	2640	wwvdgerfk.exe	55

C:\Users\Admin\AppData\Local\Temp\57efcc0242fee92bddbb8f9c25d23481.exe
"C:\Users\Admin\AppData\Local\Temp\57efcc0242fee92bddbb8f9c25d23481.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\woa.exe
  "C:\Windows\system32\woa.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\wpmjafeo.exe
    "C:\Windows\system32\wpmjafeo.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\SysWOW64\wysif.exe
      "C:\Windows\system32\wysif.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\SysWOW64\wukbxrfm.exe
        
        "C:\Windows\system32\wukbxrfm.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\wuq.exe
        
        "C:\Windows\system32\wuq.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\wrxqrul.exe
        
        "C:\Windows\system32\wrxqrul.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\wwvdgerfk.exe
        
        "C:\Windows\system32\wwvdgerfk.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\wctqupx.exe
        
        "C:\Windows\system32\wctqupx.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\woumwj.exe
        
        "C:\Windows\system32\woumwj.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1664
        
        C:\Windows\SysWOW64\wugqds.exe
        
        "C:\Windows\system32\wugqds.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\wsbnhs.exe
        
        "C:\Windows\system32\wsbnhs.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1408
        
        C:\Windows\SysWOW64\wxybvcg.exe
        
        "C:\Windows\system32\wxybvcg.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2864
        
        C:\Windows\SysWOW64\wkbmuq.exe
        
        "C:\Windows\system32\wkbmuq.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\wvctp.exe
        
        "C:\Windows\system32\wvctp.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\whrfdgxb.exe
        
        "C:\Windows\system32\whrfdgxb.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1020
        
        C:\Windows\SysWOW64\wdnfi.exe
        
        "C:\Windows\system32\wdnfi.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2552
        
        C:\Windows\SysWOW64\wtu.exe
        
        "C:\Windows\system32\wtu.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2792
        
        C:\Windows\SysWOW64\wylbfht.exe
        
        "C:\Windows\system32\wylbfht.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\wkwaceu.exe
        
        "C:\Windows\system32\wkwaceu.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:652
        
        C:\Windows\SysWOW64\waommqhp.exe
        
        "C:\Windows\system32\waommqhp.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\wwblto.exe
        
        "C:\Windows\system32\wwblto.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\wppckcnh.exe
        
        "C:\Windows\system32\wppckcnh.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\wmvyddtc.exe
        
        "C:\Windows\system32\wmvyddtc.exe"
        24⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\wreao.exe
        
        "C:\Windows\system32\wreao.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\wgupnvbqr.exe
        
        "C:\Windows\system32\wgupnvbqr.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2808
        
        C:\Windows\SysWOW64\wkknvfbe.exe
        
        "C:\Windows\system32\wkknvfbe.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\wuoliisny.exe
        
        "C:\Windows\system32\wuoliisny.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuoliisny.exe"
        29⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\wcdlwfw.exe
        
        "C:\Windows\system32\wcdlwfw.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcdlwfw.exe"
        30⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\wjxbj.exe
        
        "C:\Windows\system32\wjxbj.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\wnuoxx.exe
        
        "C:\Windows\system32\wnuoxx.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2516
        
        C:\Windows\SysWOW64\wxfuij.exe
        
        "C:\Windows\system32\wxfuij.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\wxumibng.exe
        
        "C:\Windows\system32\wxumibng.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1480
        
        C:\Windows\SysWOW64\wgclka.exe
        
        "C:\Windows\system32\wgclka.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2212
        
        C:\Windows\SysWOW64\wtqwsfl.exe
        
        "C:\Windows\system32\wtqwsfl.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3004
        
        C:\Windows\SysWOW64\wxaqyhk.exe
        
        "C:\Windows\system32\wxaqyhk.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\wagawdkj.exe
        
        "C:\Windows\system32\wagawdkj.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1412
        
        C:\Windows\SysWOW64\wbcngmsd.exe
        
        "C:\Windows\system32\wbcngmsd.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\wfncwwg.exe
        
        "C:\Windows\system32\wfncwwg.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbcngmsd.exe"
        39⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wagawdkj.exe"
        38⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxaqyhk.exe"
        37⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtqwsfl.exe"
        36⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgclka.exe"
        35⤵
        
        PID:340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxumibng.exe"
        34⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 488
        34⤵
        Program crash
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxfuij.exe"
        33⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnuoxx.exe"
        32⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjxbj.exe"
        31⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkknvfbe.exe"
        28⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgupnvbqr.exe"
        27⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wreao.exe"
        26⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmvyddtc.exe"
        25⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wppckcnh.exe"
        24⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwblto.exe"
        23⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waommqhp.exe"
        22⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkwaceu.exe"
        21⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wylbfht.exe"
        20⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtu.exe"
        19⤵
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdnfi.exe"
        18⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whrfdgxb.exe"
        17⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvctp.exe"
        16⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkbmuq.exe"
        15⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxybvcg.exe"
        14⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsbnhs.exe"
        13⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wugqds.exe"
        12⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woumwj.exe"
        11⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wctqupx.exe"
        10⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwvdgerfk.exe"
        9⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrxqrul.exe"
        8⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuq.exe"
        7⤵
        
        PID:2508
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wukbxrfm.exe"
        6⤵
        
        PID:1480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wysif.exe"
        5⤵
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpmjafeo.exe"
      4⤵
      PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woa.exe"
    3⤵
    PID:1416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\57efcc0242fee92bddbb8f9c25d23481.exe"
  2⤵
  - Deletes itself
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ALKPR4LF.txt

Filesize
98B

MD5
88217a326de915b39bf3d427111283fe

SHA1
f432e23c2b01c87b5b40ec9de2ddf84c16e3e609

SHA256
b9eab771c8e1d9b0af04a696247eaf970d55c4defb4610cb5880c345d48ecbf6

SHA512
1f95908b7d5c16202819298dadcd17c23107af237e72daacb8fb9888672d491f953461071834e5214469fa977e81b7e4e2d23ff1712cb6ca48e4ff5468594ced

Download Submit
\Windows\SysWOW64\wctqupx.exe

Filesize
265KB

MD5
0b5e6a69ecdfae27896a31d6d37f7724

SHA1
6bb709d4a754932e74216b06188924e7a3f399fe

SHA256
5cc81bf967f16ffa6b998a984d414be299db124b8563f8c04eec85419b4b6a3f

SHA512
601e584b4be503bc6ff8a5fa2ba46250da6e313fe05e217d323eed13accc974af21be3cc102679bcb28b99edfd65ea26e96b286cbf3aea2273a73bfe09c8824e

Download Submit
\Windows\SysWOW64\woa.exe

Filesize
265KB

MD5
8e922b39257518b57862492be12886c9

SHA1
c0cd95c3bf06ace528ed16233df0e434442ce5eb

SHA256
2f617da40f19277565aab8bc60446c2d1f42d638d73301535f9096333b7b6c3e

SHA512
75e6f7c6a0133481f5a67a8d19304f00128ef8c906e6c99db16f871169202231341b2f3ac53e08634da0578f9897c35328dbbf018f30f9107a7ad06d305cfd98

Download Submit
\Windows\SysWOW64\woumwj.exe

Filesize
265KB

MD5
c77ca0e97e93ffd0b259f3f6fa824ce3

SHA1
e56418d1a82961b1c71af39489a44702c221b9f4

SHA256
2b4e3dccf077629c3f065a44c1d2190573dc282fb63147d8e2932cddeac4e517

SHA512
5ad8fab40f314fed6fe086761724ff6c3dbdad7a962de0ed566687a0e956f6df73622a75fb49d6db9188f1cddab645b48e2ac91d6433d169ee9d4579603285c1

Download Submit
\Windows\SysWOW64\wpmjafeo.exe

Filesize
265KB

MD5
df0777816f3d3542204dff0d21b64d66

SHA1
e0409cd18ee91f7927bd01104398e957336e0fff

SHA256
d0644e2f9f63356be0e630e12534705e7913e2355bd944efdd30663790421533

SHA512
f6ea1774cbad4d6f002998620b810d3a2a1633a907afd632a16941ad4913edfae393da01131e43e3f8f80a056f936b4170e52f67163ee721c1637c641ae285c0

Download Submit
\Windows\SysWOW64\wrxqrul.exe

Filesize
265KB

MD5
5d2a1453d2fcc4b3801b4bf612259c3e

SHA1
8df80f85e4a2220da0ee806c05fe3db08c9b1695

SHA256
ec2cbdfe60fe3a12372b1e9f80abe110dda2feb30807a3c8e0e358b196c32819

SHA512
ce62b4067354804ca514908ab00c274b05f4b23ec71ae67fe6d94b779d837a074ffa84106ee20e9437ccdbc2823002a75f8b4058e3ccacac275d5d21124c5dde

Download Submit
\Windows\SysWOW64\wsbnhs.exe

Filesize
265KB

MD5
aa918debf3d1a59396555b8c53dbb629

SHA1
8869cef086865c4f4d1f35c48effa13bf40c4d6f

SHA256
f4796406d24b2d5fea4c4fbb24180994fcc6f6920a70e5c22f9d3dd4257222fa

SHA512
cc035aed811c5cff6f2697e5f8b8f216b94d781ddb48544c20607846c5a58c1ee4d4ed2513049f503189b95bb0c2cc11c22568eb8af386aff35e3ab101088311

Download Submit
\Windows\SysWOW64\wugqds.exe

Filesize
265KB

MD5
779bc119b229368c9efad41dcd1cdbf4

SHA1
4db3395cc43601f3bd66d24a857faf4b0e42b02d

SHA256
bbbb1714af9c7d47265240b24b89f93ea5103d888121250884ddda3945b54395

SHA512
8af5a6a1cc9203bbb904498080ba0155aa6a68815c1a8b6b30f41dc6dbe748889ce6c30432b42490622a96ea781260f8e0878d8df66100598ca9d269bc38a405

Download Submit
\Windows\SysWOW64\wukbxrfm.exe

Filesize
265KB

MD5
219bff8c34b6a9b56f74d20062fde93c

SHA1
1efaaa216adc2368b0dc51cc17d49c60e4ce489b

SHA256
005357a13ff78f7d6b2dc0e685e54756896263538d40126f579967d0ef3e50ed

SHA512
61104b7e2f6d02e2ec772eaf1fae5f8903dd66668408364952543623139d073792f3f1a17df58e73aafc946f7133a207920ec0ccc7e8b2bb6b89993f8a3918c0

Download Submit
\Windows\SysWOW64\wuq.exe

Filesize
265KB

MD5
1401157300ec33f731dcd956bcfa146d

SHA1
77b1d90d343d26bf2f524bf72cef0e2b4039be2f

SHA256
a1b7de5b7d02b23c10fb951bb706884c0e193914a3366f6a6b78d20e7efb2d3b

SHA512
07f5420f90beacb0720150711634fc9cff7301608fbe8eeaab5d071301591eae1f30934ba9d217251c465c4a3ba12169d349db49a8add414cb523cfa73d8f00c

Download Submit
\Windows\SysWOW64\wwvdgerfk.exe

Filesize
265KB

MD5
b39dba3705e91b9e7398c47b54a8c5d8

SHA1
ec68bc913fb45b97f18a0208b983f13cfeb23d37

SHA256
67ac13cf4808588bc1567a3eb07ae72e0c346f8358668966728206e815857d1d

SHA512
67664472e9cb4de68e1a18469014443643d7115b5c30c3a652b2b3ee0933752a144aeade3a3ce84528705409003163e6bc3abe11ec451d41159f9cddaa7c16e5

Download Submit
\Windows\SysWOW64\wysif.exe

Filesize
265KB

MD5
9a2c710d67cb33bf6d1413887e938b03

SHA1
c4def60d88371de060b89eb914f1f4ca9059fa4c

SHA256
95ad042aff8e4585ffcf73c20b2485e04dc58617d0d7ef2c941a4e9a5bc175e6

SHA512
c69765259d6c83d68a0bd7f98fe94f36feb3d4978213e517f1b9fc4bf75d26ff7690fb3326740ad2b1da0273aac9ded25de8b9eaecb93499766b8c35901d31c8

Download Submit
memory/1124-62-0x0000000003C90000-0x0000000003CA7000-memory.dmp

Filesize
92KB

Download
memory/1124-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1124-63-0x0000000003C90000-0x0000000003CA7000-memory.dmp

Filesize
92KB

Download
memory/1124-45-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1164-130-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1164-127-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/1164-111-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1164-128-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/1284-83-0x0000000003AC0000-0x0000000003AD7000-memory.dmp

Filesize
92KB

Download
memory/1284-86-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1284-84-0x0000000003AC0000-0x0000000003AD7000-memory.dmp

Filesize
92KB

Download
memory/1284-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1408-249-0x0000000003DA0000-0x0000000003DB7000-memory.dmp

Filesize
92KB

Download
memory/1408-250-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1408-251-0x0000000003DB0000-0x0000000003DC7000-memory.dmp

Filesize
92KB

Download
memory/1408-237-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1664-215-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1664-267-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1664-196-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1664-214-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1664-216-0x0000000003670000-0x0000000003687000-memory.dmp

Filesize
92KB

Download
memory/1700-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1700-149-0x0000000003250000-0x0000000003267000-memory.dmp

Filesize
92KB

Download
memory/1700-150-0x0000000003260000-0x0000000003277000-memory.dmp

Filesize
92KB

Download
memory/1700-151-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1748-280-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/1748-266-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1748-283-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/1748-282-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1748-281-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/2164-175-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2164-195-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2164-191-0x0000000003D70000-0x0000000003D87000-memory.dmp

Filesize
92KB

Download
memory/2164-190-0x0000000003D60000-0x0000000003D77000-memory.dmp

Filesize
92KB

Download
memory/2536-235-0x0000000003C80000-0x0000000003C97000-memory.dmp

Filesize
92KB

Download
memory/2536-236-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2536-279-0x0000000003C80000-0x0000000003C97000-memory.dmp

Filesize
92KB

Download
memory/2536-234-0x0000000003900000-0x0000000003917000-memory.dmp

Filesize
92KB

Download
memory/2536-233-0x0000000003900000-0x0000000003917000-memory.dmp

Filesize
92KB

Download
memory/2536-218-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2568-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2568-43-0x0000000003C20000-0x0000000003C37000-memory.dmp

Filesize
92KB

Download
memory/2568-110-0x0000000003C20000-0x0000000003C37000-memory.dmp

Filesize
92KB

Download
memory/2568-21-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2568-44-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2640-163-0x0000000001EA0000-0x0000000001EB7000-memory.dmp

Filesize
92KB

Download
memory/2640-174-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2640-173-0x00000000039B0000-0x00000000039C7000-memory.dmp

Filesize
92KB

Download
memory/2640-170-0x00000000039B0000-0x00000000039C7000-memory.dmp

Filesize
92KB

Download
memory/2640-152-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2792-19-0x0000000003BC0000-0x0000000003BD7000-memory.dmp

Filesize
92KB

Download
memory/2792-22-0x0000000003BC0000-0x0000000003BD7000-memory.dmp

Filesize
92KB

Download
memory/2792-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2792-11-0x0000000003BB0000-0x0000000003BC7000-memory.dmp

Filesize
92KB

Download
memory/2792-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2864-252-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2864-264-0x0000000003800000-0x0000000003817000-memory.dmp

Filesize
92KB

Download
memory/2864-265-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3032-103-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/3032-172-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/3032-105-0x0000000003C60000-0x0000000003C77000-memory.dmp

Filesize
92KB

Download
memory/3032-106-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/3032-107-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3032-108-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download