5019268b1b30531e0081fc7e4934c39abf132723a3481f3d65b69d308d503605

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d270cf6a8b1317211c033f3704aa99.exe
Size

270KB
MD5

c1d270cf6a8b1317211c033f3704aa99
SHA1

dbca3f136db30fe02f1b9fd2dcc25a3388b3efe2
SHA256

5019268b1b30531e0081fc7e4934c39abf132723a3481f3d65b69d308d503605
SHA512

ee791ca6eb9d94e744b48205421d5c289916321c9538eb752aa177ecb29c21c2d2348f0ab2296393d8bcea102b1badc7a355ca2099655bb64d7580f279449bd4
SSDEEP

3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVpuJ0:ZY7xh6SZI4z7FSVpuJ0

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Executes dropped EXE 32 IoCs

pid	Process
2584	wufaa.exe
240	wjr.exe
1444	witexr.exe
856	werdu.exe
1992	wibqe.exe
2904	wkldy.exe
608	wwupmbd.exe
2436	wlrqmi.exe
2736	wad.exe
2424	wyspic.exe
1880	wunebvgy.exe
1956	wqtqeu.exe
2336	wlkps.exe
2924	wkij.exe
1068	wtqshm.exe
884	wsnns.exe
1572	wvhk.exe
2420	wmuiy.exe
2288	whepcllr.exe
1336	watxeq.exe
776	wutaan.exe
1680	whbtufdxc.exe
920	wyuscaf.exe
852	whbdlvd.exe
320	wiott.exe
2376	wfrla.exe
2936	wfevfl.exe
2956	wjipfj.exe
324	wlqtvl.exe
936	wfullm.exe
2924	wiakyikp.exe
3040	wuukan.exe

Loads dropped DLL 64 IoCs

pid	Process
2016	c1d270cf6a8b1317211c033f3704aa99.exe
2016	c1d270cf6a8b1317211c033f3704aa99.exe
2016	c1d270cf6a8b1317211c033f3704aa99.exe
2016	c1d270cf6a8b1317211c033f3704aa99.exe
2584	wufaa.exe
2584	wufaa.exe
2584	wufaa.exe
2584	wufaa.exe
240	wjr.exe
240	wjr.exe
240	wjr.exe
240	wjr.exe
1444	witexr.exe
1444	witexr.exe
1444	witexr.exe
1444	witexr.exe
856	werdu.exe
856	werdu.exe
856	werdu.exe
856	werdu.exe
1992	wibqe.exe
1992	wibqe.exe
1992	wibqe.exe
1992	wibqe.exe
2904	wkldy.exe
2904	wkldy.exe
2904	wkldy.exe
2904	wkldy.exe
608	wwupmbd.exe
608	wwupmbd.exe
608	wwupmbd.exe
608	wwupmbd.exe
2436	wlrqmi.exe
2436	wlrqmi.exe
2436	wlrqmi.exe
2436	wlrqmi.exe
2736	wad.exe
2736	wad.exe
2736	wad.exe
2736	wad.exe
2424	wyspic.exe
2424	wyspic.exe
2424	wyspic.exe
2424	wyspic.exe
1880	wunebvgy.exe
1880	wunebvgy.exe
1880	wunebvgy.exe
1880	wunebvgy.exe
1956	wqtqeu.exe
1956	wqtqeu.exe
1956	wqtqeu.exe
1956	wqtqeu.exe
2336	wlkps.exe
2336	wlkps.exe
2336	wlkps.exe
2336	wlkps.exe
2924	wkij.exe
2924	wkij.exe
2924	wkij.exe
2924	wkij.exe
1068	wtqshm.exe
1068	wtqshm.exe
1068	wtqshm.exe
1068	wtqshm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wuukan.exe	wiakyikp.exe
File opened for modification	C:\Windows\SysWOW64\wuukan.exe	wiakyikp.exe
File created	C:\Windows\SysWOW64\wufaa.exe	c1d270cf6a8b1317211c033f3704aa99.exe
File opened for modification	C:\Windows\SysWOW64\witexr.exe	wjr.exe
File created	C:\Windows\SysWOW64\wqtqeu.exe	wunebvgy.exe
File opened for modification	C:\Windows\SysWOW64\wyuscaf.exe	whbtufdxc.exe
File opened for modification	C:\Windows\SysWOW64\wfrla.exe	wiott.exe
File created	C:\Windows\SysWOW64\wlqtvl.exe	wjipfj.exe
File created	C:\Windows\SysWOW64\wiott.exe	whbdlvd.exe
File opened for modification	C:\Windows\SysWOW64\wjr.exe	wufaa.exe
File opened for modification	C:\Windows\SysWOW64\wlrqmi.exe	wwupmbd.exe
File created	C:\Windows\SysWOW64\wutaan.exe	watxeq.exe
File created	C:\Windows\SysWOW64\wkij.exe	wlkps.exe
File created	C:\Windows\SysWOW64\wmuiy.exe	wvhk.exe
File created	C:\Windows\SysWOW64\wsnns.exe	wtqshm.exe
File created	C:\Windows\SysWOW64\whbtufdxc.exe	wutaan.exe
File created	C:\Windows\SysWOW64\wyuscaf.exe	whbtufdxc.exe
File opened for modification	C:\Windows\SysWOW64\wufaa.exe	c1d270cf6a8b1317211c033f3704aa99.exe
File created	C:\Windows\SysWOW64\wibqe.exe	werdu.exe
File created	C:\Windows\SysWOW64\wwupmbd.exe	wkldy.exe
File opened for modification	C:\Windows\SysWOW64\wutaan.exe	watxeq.exe
File opened for modification	C:\Windows\SysWOW64\wjipfj.exe	wfevfl.exe
File opened for modification	C:\Windows\SysWOW64\wlkps.exe	wqtqeu.exe
File opened for modification	C:\Windows\SysWOW64\wkij.exe	wlkps.exe
File opened for modification	C:\Windows\SysWOW64\wtqshm.exe	wkij.exe
File created	C:\Windows\SysWOW64\wfevfl.exe	wfrla.exe
File opened for modification	C:\Windows\SysWOW64\wlqtvl.exe	wjipfj.exe
File opened for modification	C:\Windows\SysWOW64\wiakyikp.exe	wfullm.exe
File created	C:\Windows\SysWOW64\wlkps.exe	wqtqeu.exe
File created	C:\Windows\SysWOW64\wfullm.exe	wlqtvl.exe
File created	C:\Windows\SysWOW64\werdu.exe	witexr.exe
File opened for modification	C:\Windows\SysWOW64\werdu.exe	witexr.exe
File opened for modification	C:\Windows\SysWOW64\wkldy.exe	wibqe.exe
File created	C:\Windows\SysWOW64\whepcllr.exe	wmuiy.exe
File created	C:\Windows\SysWOW64\witexr.exe	wjr.exe
File created	C:\Windows\SysWOW64\wkldy.exe	wibqe.exe
File created	C:\Windows\SysWOW64\wad.exe	wlrqmi.exe
File opened for modification	C:\Windows\SysWOW64\wmuiy.exe	wvhk.exe
File created	C:\Windows\SysWOW64\watxeq.exe	whepcllr.exe
File opened for modification	C:\Windows\SysWOW64\wvhk.exe	wsnns.exe
File created	C:\Windows\SysWOW64\wunebvgy.exe	wyspic.exe
File opened for modification	C:\Windows\SysWOW64\wqtqeu.exe	wunebvgy.exe
File created	C:\Windows\SysWOW64\wtbyuys.exe	wuukan.exe
File opened for modification	C:\Windows\SysWOW64\wwupmbd.exe	wkldy.exe
File opened for modification	C:\Windows\SysWOW64\wad.exe	wlrqmi.exe
File created	C:\Windows\SysWOW64\wyspic.exe	wad.exe
File opened for modification	C:\Windows\SysWOW64\watxeq.exe	whepcllr.exe
File created	C:\Windows\SysWOW64\wlrqmi.exe	wwupmbd.exe
File opened for modification	C:\Windows\SysWOW64\wsnns.exe	wtqshm.exe
File opened for modification	C:\Windows\SysWOW64\whepcllr.exe	wmuiy.exe
File opened for modification	C:\Windows\SysWOW64\wyspic.exe	wad.exe
File created	C:\Windows\SysWOW64\wtqshm.exe	wkij.exe
File created	C:\Windows\SysWOW64\wjipfj.exe	wfevfl.exe
File opened for modification	C:\Windows\SysWOW64\whbdlvd.exe	wyuscaf.exe
File opened for modification	C:\Windows\SysWOW64\wibqe.exe	werdu.exe
File opened for modification	C:\Windows\SysWOW64\whbtufdxc.exe	wutaan.exe
File created	C:\Windows\SysWOW64\whbdlvd.exe	wyuscaf.exe
File opened for modification	C:\Windows\SysWOW64\wiott.exe	whbdlvd.exe
File created	C:\Windows\SysWOW64\wfrla.exe	wiott.exe
File opened for modification	C:\Windows\SysWOW64\wfevfl.exe	wfrla.exe
File opened for modification	C:\Windows\SysWOW64\wfullm.exe	wlqtvl.exe
File created	C:\Windows\SysWOW64\wiakyikp.exe	wfullm.exe
File created	C:\Windows\SysWOW64\wjr.exe	wufaa.exe
File opened for modification	C:\Windows\SysWOW64\wunebvgy.exe	wyspic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2584	2016	c1d270cf6a8b1317211c033f3704aa99.exe	29
PID 2016 wrote to memory of 2584	2016	c1d270cf6a8b1317211c033f3704aa99.exe	29
PID 2016 wrote to memory of 2584	2016	c1d270cf6a8b1317211c033f3704aa99.exe	29
PID 2016 wrote to memory of 2584	2016	c1d270cf6a8b1317211c033f3704aa99.exe	29
PID 2016 wrote to memory of 2036	2016	c1d270cf6a8b1317211c033f3704aa99.exe	30
PID 2016 wrote to memory of 2036	2016	c1d270cf6a8b1317211c033f3704aa99.exe	30
PID 2016 wrote to memory of 2036	2016	c1d270cf6a8b1317211c033f3704aa99.exe	30
PID 2016 wrote to memory of 2036	2016	c1d270cf6a8b1317211c033f3704aa99.exe	30
PID 2584 wrote to memory of 240	2584	wufaa.exe	32
PID 2584 wrote to memory of 240	2584	wufaa.exe	32
PID 2584 wrote to memory of 240	2584	wufaa.exe	32
PID 2584 wrote to memory of 240	2584	wufaa.exe	32
PID 2584 wrote to memory of 1368	2584	wufaa.exe	33
PID 2584 wrote to memory of 1368	2584	wufaa.exe	33
PID 2584 wrote to memory of 1368	2584	wufaa.exe	33
PID 2584 wrote to memory of 1368	2584	wufaa.exe	33
PID 240 wrote to memory of 1444	240	wjr.exe	35
PID 240 wrote to memory of 1444	240	wjr.exe	35
PID 240 wrote to memory of 1444	240	wjr.exe	35
PID 240 wrote to memory of 1444	240	wjr.exe	35
PID 240 wrote to memory of 1848	240	wjr.exe	36
PID 240 wrote to memory of 1848	240	wjr.exe	36
PID 240 wrote to memory of 1848	240	wjr.exe	36
PID 240 wrote to memory of 1848	240	wjr.exe	36
PID 1444 wrote to memory of 856	1444	witexr.exe	39
PID 1444 wrote to memory of 856	1444	witexr.exe	39
PID 1444 wrote to memory of 856	1444	witexr.exe	39
PID 1444 wrote to memory of 856	1444	witexr.exe	39
PID 1444 wrote to memory of 2720	1444	witexr.exe	40
PID 1444 wrote to memory of 2720	1444	witexr.exe	40
PID 1444 wrote to memory of 2720	1444	witexr.exe	40
PID 1444 wrote to memory of 2720	1444	witexr.exe	40
PID 856 wrote to memory of 1992	856	werdu.exe	42
PID 856 wrote to memory of 1992	856	werdu.exe	42
PID 856 wrote to memory of 1992	856	werdu.exe	42
PID 856 wrote to memory of 1992	856	werdu.exe	42
PID 856 wrote to memory of 784	856	werdu.exe	43
PID 856 wrote to memory of 784	856	werdu.exe	43
PID 856 wrote to memory of 784	856	werdu.exe	43
PID 856 wrote to memory of 784	856	werdu.exe	43
PID 1992 wrote to memory of 2904	1992	wibqe.exe	45
PID 1992 wrote to memory of 2904	1992	wibqe.exe	45
PID 1992 wrote to memory of 2904	1992	wibqe.exe	45
PID 1992 wrote to memory of 2904	1992	wibqe.exe	45
PID 1992 wrote to memory of 2924	1992	wibqe.exe	46
PID 1992 wrote to memory of 2924	1992	wibqe.exe	46
PID 1992 wrote to memory of 2924	1992	wibqe.exe	46
PID 1992 wrote to memory of 2924	1992	wibqe.exe	46
PID 2904 wrote to memory of 608	2904	wkldy.exe	49
PID 2904 wrote to memory of 608	2904	wkldy.exe	49
PID 2904 wrote to memory of 608	2904	wkldy.exe	49
PID 2904 wrote to memory of 608	2904	wkldy.exe	49
PID 2904 wrote to memory of 2108	2904	wkldy.exe	50
PID 2904 wrote to memory of 2108	2904	wkldy.exe	50
PID 2904 wrote to memory of 2108	2904	wkldy.exe	50
PID 2904 wrote to memory of 2108	2904	wkldy.exe	50
PID 608 wrote to memory of 2436	608	wwupmbd.exe	52
PID 608 wrote to memory of 2436	608	wwupmbd.exe	52
PID 608 wrote to memory of 2436	608	wwupmbd.exe	52
PID 608 wrote to memory of 2436	608	wwupmbd.exe	52
PID 608 wrote to memory of 2580	608	wwupmbd.exe	53
PID 608 wrote to memory of 2580	608	wwupmbd.exe	53
PID 608 wrote to memory of 2580	608	wwupmbd.exe	53
PID 608 wrote to memory of 2580	608	wwupmbd.exe	53

C:\Users\Admin\AppData\Local\Temp\c1d270cf6a8b1317211c033f3704aa99.exe
"C:\Users\Admin\AppData\Local\Temp\c1d270cf6a8b1317211c033f3704aa99.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\wufaa.exe
  "C:\Windows\system32\wufaa.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\wjr.exe
    "C:\Windows\system32\wjr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\SysWOW64\witexr.exe
      "C:\Windows\system32\witexr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Windows\SysWOW64\werdu.exe
        
        "C:\Windows\system32\werdu.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:856
      - C:\Windows\SysWOW64\wibqe.exe
        
        "C:\Windows\system32\wibqe.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\wkldy.exe
        
        "C:\Windows\system32\wkldy.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\wwupmbd.exe
        
        "C:\Windows\system32\wwupmbd.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:608
        
        C:\Windows\SysWOW64\wlrqmi.exe
        
        "C:\Windows\system32\wlrqmi.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2436
        
        C:\Windows\SysWOW64\wad.exe
        
        "C:\Windows\system32\wad.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\wyspic.exe
        
        "C:\Windows\system32\wyspic.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\wunebvgy.exe
        
        "C:\Windows\system32\wunebvgy.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\wqtqeu.exe
        
        "C:\Windows\system32\wqtqeu.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\wlkps.exe
        
        "C:\Windows\system32\wlkps.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\wkij.exe
        
        "C:\Windows\system32\wkij.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\wtqshm.exe
        
        "C:\Windows\system32\wtqshm.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1068
        
        C:\Windows\SysWOW64\wsnns.exe
        
        "C:\Windows\system32\wsnns.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\wvhk.exe
        
        "C:\Windows\system32\wvhk.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\wmuiy.exe
        
        "C:\Windows\system32\wmuiy.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\whepcllr.exe
        
        "C:\Windows\system32\whepcllr.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\watxeq.exe
        
        "C:\Windows\system32\watxeq.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1336
        
        C:\Windows\SysWOW64\wutaan.exe
        
        "C:\Windows\system32\wutaan.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:776
        
        C:\Windows\SysWOW64\whbtufdxc.exe
        
        "C:\Windows\system32\whbtufdxc.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1680
        
        C:\Windows\SysWOW64\wyuscaf.exe
        
        "C:\Windows\system32\wyuscaf.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:920
        
        C:\Windows\SysWOW64\whbdlvd.exe
        
        "C:\Windows\system32\whbdlvd.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:852
        
        C:\Windows\SysWOW64\wiott.exe
        
        "C:\Windows\system32\wiott.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:320
        
        C:\Windows\SysWOW64\wfrla.exe
        
        "C:\Windows\system32\wfrla.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2376
        
        C:\Windows\SysWOW64\wfevfl.exe
        
        "C:\Windows\system32\wfevfl.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\wjipfj.exe
        
        "C:\Windows\system32\wjipfj.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\wlqtvl.exe
        
        "C:\Windows\system32\wlqtvl.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:324
        
        C:\Windows\SysWOW64\wfullm.exe
        
        "C:\Windows\system32\wfullm.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:936
        
        C:\Windows\SysWOW64\wiakyikp.exe
        
        "C:\Windows\system32\wiakyikp.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\wuukan.exe
        
        "C:\Windows\system32\wuukan.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiakyikp.exe"
        33⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfullm.exe"
        32⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlqtvl.exe"
        31⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjipfj.exe"
        30⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfevfl.exe"
        29⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfrla.exe"
        28⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiott.exe"
        27⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whbdlvd.exe"
        26⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyuscaf.exe"
        25⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whbtufdxc.exe"
        24⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wutaan.exe"
        23⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\watxeq.exe"
        22⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whepcllr.exe"
        21⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmuiy.exe"
        20⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvhk.exe"
        19⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsnns.exe"
        18⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtqshm.exe"
        17⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkij.exe"
        16⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlkps.exe"
        15⤵
        
        PID:908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqtqeu.exe"
        14⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wunebvgy.exe"
        13⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyspic.exe"
        12⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wad.exe"
        11⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlrqmi.exe"
        10⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwupmbd.exe"
        9⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkldy.exe"
        8⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wibqe.exe"
        7⤵
        
        PID:2924
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\werdu.exe"
        6⤵
        
        PID:784
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\witexr.exe"
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjr.exe"
      4⤵
      PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wufaa.exe"
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\c1d270cf6a8b1317211c033f3704aa99.exe"
  2⤵
  - Deletes itself
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9EABGGCW.txt

Filesize
99B

MD5
d72535adcebe04b4e6257326e2a426fe

SHA1
df99915cf57259355cf0ddd39d9c89b55033efb8

SHA256
992c43ff2fb58b03d64a8325cc5a60f85fa4808f74d6eb8ea15f73727ded60d2

SHA512
062b8301cb15c2c42a6d66dbef59923d91f7570c70e908e3bdcdb011fb54ca3594b4b63640cd706e597d049eb4f753d8a86dd443f744c1c9b0742ac224ff6259

Download Submit
C:\Windows\SysWOW64\wufaa.exe

Filesize
51KB

MD5
0cee5f66079f45feec76c35368a4688f

SHA1
a8c81ae1c6dfa9ff2c46ed439a93724399df0733

SHA256
9e379d041989552019ba7509641ab5f961774fb27100dd490a3fd58bd1bfef89

SHA512
4e1ab492299d74d5308b8c51ae70ebfed16ebc1d8bdcd88d553941da21882ae2d1662efeb23eaa14ba8970fec94487ad90342d91af8bab9141cfd3a765f36441

Download Submit
C:\Windows\SysWOW64\wufaa.exe

Filesize
4KB

MD5
35218b7a613edc602cb771f45d5a49a3

SHA1
ac380317450a85a7ba10bcc29a91d9ebd670c88c

SHA256
0fb17be4088847080f60d759560a72d46c0889e09765f116d18f53268cfcfafc

SHA512
fb752434004dc7bd74528be6e8bf916e30d56f6352fdc2da37a4d6d6646ca5d6f7e03158c8f25eb32745a4271d4d75c0812517bd3ed5355c0d2597ab5d43ac2b

Download Submit
\Windows\SysWOW64\wad.exe

Filesize
270KB

MD5
1ade4027fa6454b3fd7303ed34e13e57

SHA1
9db2a04a6420b97b9d6a275d8f7760f6e1b69b7e

SHA256
cbd27239ac073ac8d8fcb1c8080e1002bea2f6b12bd4169d1742d26f33dfce73

SHA512
cc9c14aae4344745a2ce493c063ab5916ea1b1c3e3a3bbf54d738e95d5fc8a019bfd40701dd76c04f9043c8fa0a48947a740807f2c0993843ca3846044d417bd

Download Submit
\Windows\SysWOW64\werdu.exe

Filesize
270KB

MD5
4e301d4c9cd8895bcd187e8d5360da0e

SHA1
9fc433ed6c27a84420d5d933dd5a61c8623494bc

SHA256
75ffacca49916ca21c41d25b6f83709eb52e77c1a4cd742e6e33c4c0f349f055

SHA512
114532358e601fbe43062d5c57cd00d7bb15edf1ce5699f46674f7ac4b8003541c9d142166b9125917e95de779e8fc3cb1685a9c56095b78212f6e1bc9f49347

Download Submit
\Windows\SysWOW64\wibqe.exe

Filesize
270KB

MD5
7a28ee575f16b2661cfd3e8986052fa3

SHA1
c97f7e590424715772b15e527b776fa928842dd5

SHA256
6fd3852bf61d11ebb51cc49955aa7332917e21b3a3892feabec4e5af97ee2967

SHA512
fe2e04e7735d5aeabc69125d3fd4b9dcab6d898b9b0c9f023001e32b3ededd4d204a80ef570e79f281dca348b9f998d8114823814b801554d134af94567f0317

Download Submit
\Windows\SysWOW64\witexr.exe

Filesize
270KB

MD5
06aa7ac99d57dd88957d7f76c8008c76

SHA1
8647d0b54609d4f5595ac187b1686d093a20a996

SHA256
eb1b4c398efb30beac2b3166c0cd2605db1d6d5d7d1b9c79d1869c560ec76a83

SHA512
b83171ee2b17098a26ab050de0a62a9902d29e99e5b3a6585b9d26baa84fdf3dcd653b33dff0e3aad0b24fc01ffb1be559713bbc2f2bf4857c3801f1b1778d5f

Download Submit
\Windows\SysWOW64\wjr.exe

Filesize
270KB

MD5
50533484656ffd853898d52ff437a383

SHA1
27f7d0afe4aeaeb4cf2bc1ea8c6addb0894c4ff4

SHA256
4979c673fa392677ec400bb0ea9d8323a3e1797641d7a3faece29691d290daea

SHA512
f087c80ff0f2787b10409b7f6f8ab480f095ca7f61b1019b48832071e5af89e97dba18023a86b2d0d723d1760e8380b8fad2dcc993bc457b495bc2b822108363

Download Submit
\Windows\SysWOW64\wkldy.exe

Filesize
270KB

MD5
8cf6532c075110fee670486b94a345a2

SHA1
13893c2715349029b5bf3c4f3a660ab17ddc8371

SHA256
16f92c041525e69705e27e26da1cb59d5056d20802e5ab4b3ed06090c54e42ed

SHA512
8f813cdc55fba758b6ca4e93d3a1533fa147c22533afd71b15d18da4f751227b1ee48f92422d6d20347bb5802aff18bcac9919d3101a047cdbc673315bba1905

Download Submit
\Windows\SysWOW64\wlrqmi.exe

Filesize
270KB

MD5
02f278b28abb13ef41e39843f5278300

SHA1
6068d65e7fd4747459a43d99b313b19c8797296f

SHA256
61b531fde4de96be410483bb276c4df2a5d895b12db3cf55098316ead6f002f5

SHA512
5b1b58f6d94184f957009268dc9a4dc34aa9079a57ba6d73d0e9c54eb471bf6c046141bba4b069c72cc6ec42eac6ec761edd121249e0f63faed5a842b4874ebb

Download Submit
\Windows\SysWOW64\wufaa.exe

Filesize
251KB

MD5
004bd8f843ce5fdc386f1c11275999e2

SHA1
4674e2d197c7aad173fe9ca35c41aa479bbe2d7d

SHA256
04b77f9c115c34cc8bd0dd726f9a72a84aa8bcefacee5211997537df9215da4e

SHA512
5ad90755204caf4b5cc6fdb0b513dc56cb1ffc44de279afd0e5e6fec2732234cfe5e1f99297254c70123937cc561cfd8335da438629e64db91c4e693ac665e97

Download Submit
\Windows\SysWOW64\wufaa.exe

Filesize
270KB

MD5
447ee0b839d95b0fd93e2164be27de91

SHA1
9deaa5afefea474fa8db29640c504ba9ce784363

SHA256
a186b118ed43b395d0697a469c97a825d3d21f895a115d11ee985014a8249f58

SHA512
bddb839f52ddbb5ab3cae1a505129a727357a64e4ec026dbde6a2a7776d31842805c4f990acbac17306a4ce5fdd55af25bad92a2c73e0150eb7a4501b533dc92

Download Submit
\Windows\SysWOW64\wunebvgy.exe

Filesize
270KB

MD5
fb0bc73e7f92112450b12de0602ef91a

SHA1
7525fb1cf8cc5ef50f753388a7e975a046b31daf

SHA256
089b3d44b9450fc9656f7cfe05135eb8bf8156e135248fb86b9ae310691f1d9e

SHA512
e1a55ddc337ca250ad27bee16b1b26a9fe419b6ebf06dc515320a78d85f5ddfd8b81f8520b8c98faeceabd5f5b832558dab05418c80dab6ad6a01d9aa8f61aeb

Download Submit
\Windows\SysWOW64\wwupmbd.exe

Filesize
270KB

MD5
71b1277ed59f426e7bda12f316a924d0

SHA1
d53d3ed1b0a47d701414ea8cdbfc09af5d543158

SHA256
1d64da4734ce10966b36d853f9a9d4df74df41cd59e074cd658972ec3e9353f7

SHA512
09b3d9397625f5357e523c4412ddea51580da3ab3e5e5d379c10c0d130f1bdf086536352f56e960199ce90ad8c4728f30a176afac940bf1610385100b4819916

Download Submit
\Windows\SysWOW64\wyspic.exe

Filesize
270KB

MD5
c767f27bec2f375173ead02bb5b2a627

SHA1
bb94bf0357707cb0c516b4d1f053b4b022ad0d79

SHA256
9742b8f0659f46a7bd46144e48d552d5238470da7c71c2e195db8c324409ffad

SHA512
28d55d208730e15f0e5824cb6dbd473ac7aef8cc8bbbbe72495e5d591e3ef2a81ca188618d50193b006727bfeb53bcc4ed2899c8eb56f51e7ff29a98050c1069

Download Submit
memory/240-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/240-45-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/240-63-0x0000000003E20000-0x0000000003E37000-memory.dmp

Filesize
92KB

Download
memory/608-151-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/608-170-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/608-168-0x0000000003E70000-0x0000000003E87000-memory.dmp

Filesize
92KB

Download
memory/856-104-0x0000000003D10000-0x0000000003D27000-memory.dmp

Filesize
92KB

Download
memory/856-108-0x0000000003D10000-0x0000000003D27000-memory.dmp

Filesize
92KB

Download
memory/856-109-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/856-86-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/856-106-0x0000000003D10000-0x0000000003D27000-memory.dmp

Filesize
92KB

Download
memory/1444-84-0x0000000003650000-0x0000000003667000-memory.dmp

Filesize
92KB

Download
memory/1444-88-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1444-83-0x0000000003650000-0x0000000003667000-memory.dmp

Filesize
92KB

Download
memory/1444-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1880-250-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1880-247-0x0000000003560000-0x0000000003577000-memory.dmp

Filesize
92KB

Download
memory/1880-248-0x0000000003560000-0x0000000003577000-memory.dmp

Filesize
92KB

Download
memory/1880-249-0x0000000004130000-0x0000000004147000-memory.dmp

Filesize
92KB

Download
memory/1880-234-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-259-0x00000000035F0000-0x0000000003607000-memory.dmp

Filesize
92KB

Download
memory/1956-265-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-258-0x00000000035F0000-0x0000000003607000-memory.dmp

Filesize
92KB

Download
memory/1956-264-0x00000000035F0000-0x0000000003607000-memory.dmp

Filesize
92KB

Download
memory/1992-127-0x00000000035A0000-0x00000000035B7000-memory.dmp

Filesize
92KB

Download
memory/1992-171-0x00000000035A0000-0x00000000035B7000-memory.dmp

Filesize
92KB

Download
memory/1992-110-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1992-128-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2016-20-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/2016-19-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/2016-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2016-11-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/2016-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2016-18-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

Filesize
92KB

Download
memory/2336-282-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2336-266-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2336-279-0x0000000002360000-0x0000000002377000-memory.dmp

Filesize
92KB

Download
memory/2336-280-0x0000000002370000-0x0000000002387000-memory.dmp

Filesize
92KB

Download
memory/2424-235-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2424-233-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/2424-232-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/2424-216-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2436-195-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2436-190-0x0000000003FE0000-0x0000000003FF7000-memory.dmp

Filesize
92KB

Download
memory/2436-192-0x0000000003FE0000-0x0000000003FF7000-memory.dmp

Filesize
92KB

Download
memory/2436-193-0x0000000003FE0000-0x0000000003FF7000-memory.dmp

Filesize
92KB

Download
memory/2436-172-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2584-41-0x00000000032E0000-0x00000000032F7000-memory.dmp

Filesize
92KB

Download
memory/2584-42-0x00000000032E0000-0x00000000032F7000-memory.dmp

Filesize
92KB

Download
memory/2584-44-0x00000000039B0000-0x00000000039C7000-memory.dmp

Filesize
92KB

Download
memory/2584-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2584-47-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2736-213-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2736-212-0x0000000003E30000-0x0000000003E47000-memory.dmp

Filesize
92KB

Download
memory/2736-215-0x0000000003E30000-0x0000000003E47000-memory.dmp

Filesize
92KB

Download
memory/2736-194-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2736-267-0x0000000003E30000-0x0000000003E47000-memory.dmp

Filesize
92KB

Download
memory/2904-129-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2904-149-0x0000000004270000-0x0000000004287000-memory.dmp

Filesize
92KB

Download
memory/2904-189-0x0000000004270000-0x0000000004287000-memory.dmp

Filesize
92KB

Download
memory/2904-150-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2904-146-0x0000000004110000-0x0000000004127000-memory.dmp

Filesize
92KB

Download
memory/2904-147-0x0000000004110000-0x0000000004127000-memory.dmp

Filesize
92KB

Download
memory/2924-281-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download