b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
Size

90KB
MD5

d73e565f8a2fc8ed530d3f9c1c2effd0
SHA1

89152dac91d3d5aea080d7303e5f924a7f87d893
SHA256

b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a
SHA512

3cb4a8109dad68cb1f0a99383dabf77e1c49eb473d5347aee830586e57d3a169c2b8002d4625d3421b29edf03bba17c6f0551106c9679f8210d815c36c246132
SSDEEP

768:Qvw9816vhKQLroyU4/wQRNrfrunMxVFA3b7glws:YEGh0oyUl2unMxVS3Hgz

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF77C2A2-D3A2-4315-B577-BFB751071011}	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}	{327CF471-EC2B-479c-9408-2E76B7744991}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC34B392-A249-481e-95AA-27E953AB1030}\stubpath = "C:\\Windows\\{EC34B392-A249-481e-95AA-27E953AB1030}.exe"	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}\stubpath = "C:\\Windows\\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe"	{EC34B392-A249-481e-95AA-27E953AB1030}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{978449AB-59B6-4728-8224-8C093FC4AE0B}	{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}\stubpath = "C:\\Windows\\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe"	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}	{F4683618-36FD-4168-9A58-327220C2749C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}	{EC34B392-A249-481e-95AA-27E953AB1030}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{327CF471-EC2B-479c-9408-2E76B7744991}	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{327CF471-EC2B-479c-9408-2E76B7744991}\stubpath = "C:\\Windows\\{327CF471-EC2B-479c-9408-2E76B7744991}.exe"	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4683618-36FD-4168-9A58-327220C2749C}	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF77C2A2-D3A2-4315-B577-BFB751071011}\stubpath = "C:\\Windows\\{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe"	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}\stubpath = "C:\\Windows\\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe"	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}\stubpath = "C:\\Windows\\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe"	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{978449AB-59B6-4728-8224-8C093FC4AE0B}\stubpath = "C:\\Windows\\{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe"	{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4683618-36FD-4168-9A58-327220C2749C}\stubpath = "C:\\Windows\\{F4683618-36FD-4168-9A58-327220C2749C}.exe"	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}\stubpath = "C:\\Windows\\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe"	{F4683618-36FD-4168-9A58-327220C2749C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}\stubpath = "C:\\Windows\\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe"	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}\stubpath = "C:\\Windows\\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe"	{327CF471-EC2B-479c-9408-2E76B7744991}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC34B392-A249-481e-95AA-27E953AB1030}	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe

Executes dropped EXE 12 IoCs

pid	Process
2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe
3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe
5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe
1152	{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
2860	{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
File created	C:\Windows\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	{327CF471-EC2B-479c-9408-2E76B7744991}.exe
File created	C:\Windows\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe	{EC34B392-A249-481e-95AA-27E953AB1030}.exe
File created	C:\Windows\{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe	{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
File created	C:\Windows\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
File created	C:\Windows\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	{F4683618-36FD-4168-9A58-327220C2749C}.exe
File created	C:\Windows\{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
File created	C:\Windows\{327CF471-EC2B-479c-9408-2E76B7744991}.exe	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
File created	C:\Windows\{EC34B392-A249-481e-95AA-27E953AB1030}.exe	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
File created	C:\Windows\{F4683618-36FD-4168-9A58-327220C2749C}.exe	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
File created	C:\Windows\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
File created	C:\Windows\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
Token: SeIncBasePriorityPrivilege	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
Token: SeIncBasePriorityPrivilege	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe
Token: SeIncBasePriorityPrivilege	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
Token: SeIncBasePriorityPrivilege	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
Token: SeIncBasePriorityPrivilege	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
Token: SeIncBasePriorityPrivilege	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
Token: SeIncBasePriorityPrivilege	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
Token: SeIncBasePriorityPrivilege	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe
Token: SeIncBasePriorityPrivilege	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
Token: SeIncBasePriorityPrivilege	4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe
Token: SeIncBasePriorityPrivilege	1152	{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2804	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	99
PID 3352 wrote to memory of 2804	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	99
PID 3352 wrote to memory of 2804	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	99
PID 3352 wrote to memory of 3628	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	100
PID 3352 wrote to memory of 3628	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	100
PID 3352 wrote to memory of 3628	3352	b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe	100
PID 2804 wrote to memory of 4928	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	101
PID 2804 wrote to memory of 4928	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	101
PID 2804 wrote to memory of 4928	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	101
PID 2804 wrote to memory of 3036	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	102
PID 2804 wrote to memory of 3036	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	102
PID 2804 wrote to memory of 3036	2804	{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe	102
PID 4928 wrote to memory of 3524	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	105
PID 4928 wrote to memory of 3524	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	105
PID 4928 wrote to memory of 3524	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	105
PID 4928 wrote to memory of 4244	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	106
PID 4928 wrote to memory of 4244	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	106
PID 4928 wrote to memory of 4244	4928	{F4683618-36FD-4168-9A58-327220C2749C}.exe	106
PID 3524 wrote to memory of 5016	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	108
PID 3524 wrote to memory of 5016	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	108
PID 3524 wrote to memory of 5016	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	108
PID 3524 wrote to memory of 3036	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	109
PID 3524 wrote to memory of 3036	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	109
PID 3524 wrote to memory of 3036	3524	{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe	109
PID 5016 wrote to memory of 2168	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	110
PID 5016 wrote to memory of 2168	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	110
PID 5016 wrote to memory of 2168	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	110
PID 5016 wrote to memory of 2488	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	111
PID 5016 wrote to memory of 2488	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	111
PID 5016 wrote to memory of 2488	5016	{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe	111
PID 2168 wrote to memory of 4000	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	113
PID 2168 wrote to memory of 4000	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	113
PID 2168 wrote to memory of 4000	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	113
PID 2168 wrote to memory of 3528	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	114
PID 2168 wrote to memory of 3528	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	114
PID 2168 wrote to memory of 3528	2168	{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe	114
PID 4000 wrote to memory of 4800	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	115
PID 4000 wrote to memory of 4800	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	115
PID 4000 wrote to memory of 4800	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	115
PID 4000 wrote to memory of 392	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	116
PID 4000 wrote to memory of 392	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	116
PID 4000 wrote to memory of 392	4000	{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe	116
PID 4800 wrote to memory of 3972	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	117
PID 4800 wrote to memory of 3972	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	117
PID 4800 wrote to memory of 3972	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	117
PID 4800 wrote to memory of 2208	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	118
PID 4800 wrote to memory of 2208	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	118
PID 4800 wrote to memory of 2208	4800	{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe	118
PID 3972 wrote to memory of 5080	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	123
PID 3972 wrote to memory of 5080	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	123
PID 3972 wrote to memory of 5080	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	123
PID 3972 wrote to memory of 2428	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	124
PID 3972 wrote to memory of 2428	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	124
PID 3972 wrote to memory of 2428	3972	{327CF471-EC2B-479c-9408-2E76B7744991}.exe	124
PID 5080 wrote to memory of 4788	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	130
PID 5080 wrote to memory of 4788	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	130
PID 5080 wrote to memory of 4788	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	130
PID 5080 wrote to memory of 1356	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	131
PID 5080 wrote to memory of 1356	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	131
PID 5080 wrote to memory of 1356	5080	{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe	131
PID 4788 wrote to memory of 1152	4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe	132
PID 4788 wrote to memory of 1152	4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe	132
PID 4788 wrote to memory of 1152	4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe	132
PID 4788 wrote to memory of 3428	4788	{EC34B392-A249-481e-95AA-27E953AB1030}.exe	133

C:\Users\Admin\AppData\Local\Temp\b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe
"C:\Users\Admin\AppData\Local\Temp\b349b2dc38456ec7e9139e8e9ecccb56891d51c10cd871b4675dc3428107cb7a.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
  C:\Windows\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\{F4683618-36FD-4168-9A58-327220C2749C}.exe
    C:\Windows\{F4683618-36FD-4168-9A58-327220C2749C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
      C:\Windows\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\Windows\{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
        
        C:\Windows\{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
        
        C:\Windows\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
        
        C:\Windows\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
        
        C:\Windows\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\{327CF471-EC2B-479c-9408-2E76B7744991}.exe
        
        C:\Windows\{327CF471-EC2B-479c-9408-2E76B7744991}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
        
        C:\Windows\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\{EC34B392-A249-481e-95AA-27E953AB1030}.exe
        
        C:\Windows\{EC34B392-A249-481e-95AA-27E953AB1030}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
        
        C:\Windows\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
        
        C:\Windows\{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe
        
        C:\Windows\{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe
        13⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D9AF~1.EXE > nul
        13⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EC34B~1.EXE > nul
        12⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CC8A~1.EXE > nul
        11⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{327CF~1.EXE > nul
        10⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{952C8~1.EXE > nul
        9⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DEB99~1.EXE > nul
        8⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F925B~1.EXE > nul
        7⤵
        
        PID:3528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BF77C~1.EXE > nul
        6⤵
        
        PID:2488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EE41~1.EXE > nul
        5⤵
        
        PID:3036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F4683~1.EXE > nul
      4⤵
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E070B~1.EXE > nul
    3⤵
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B349B2~1.EXE > nul
  2⤵
  PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0D9AFD31-CCCC-42a3-AA45-85FA31AC0088}.exe

Filesize
90KB

MD5
bb3de94d23d04be980d7e3efbfb8ab44

SHA1
15fb541d6764609a43638e0227a9383436197932

SHA256
8bd580ac94805399c5a4efb12e242c7548447739df45f4504e0f103f4439a931

SHA512
071eed8b18511341533f46315488c78860716b7cde36e9db94c9fbae8cd31f6b66a4f5d96bf6ef703a0078ac82290a487c7d60a1cd6eb968f6dccb27bf6db6ef

Download Submit
C:\Windows\{327CF471-EC2B-479c-9408-2E76B7744991}.exe

Filesize
90KB

MD5
1baa7d48d4d455da41787ee811a89504

SHA1
266bc22cf41f95661b1387b20f2af1c084fd61aa

SHA256
256f584e09b70e48e6d7b523404e4e2ee07785070dd8b1576b8387c27195af74

SHA512
52f1b5ea56f50631c977705a73fdb5287efa915ef99b1577821ad0d0786433a6b424413ccba4f60498b0099c029580219559ffc04e5932e22f6374822553340e

Download Submit
C:\Windows\{6EE418C5-9516-4bc4-92F0-735B6B93C4DC}.exe

Filesize
90KB

MD5
22a37404d731ae8d580588fd9cc75bfc

SHA1
20f41d41b5a052ca5a4a83ca34d75a46bd6cf487

SHA256
ced64d9359713bf19c8424d4df2d9b29497044e5bb7f9e4fa8843097cc5cefc3

SHA512
31d0719dc1749268d5943252332e5e4c65a23d63f1129f80ae2e4c3fe0a8b522d7caa882ca7faa9b3c1c415571118074c63bee9b840d37bcfcefc9cd2b93c0d1

Download Submit
C:\Windows\{7CC8A94E-77E0-411b-AF40-F2D1C8918C45}.exe

Filesize
90KB

MD5
e8769b9e5a060881bad6c8e82da36bf3

SHA1
afd62f98281e3b1511cc58cfbe55c0883eb4a314

SHA256
f0f51fc43e5734a9e8e788a4564f8bd738d822827d6f417da7b2647892d28a4b

SHA512
1ee62c1d82427c20ec5a9cde2990e0259515fe21d819068790ab88792e9680a1f5feb75a571f6dfeb85c687157e18e6a6e3d352fad7361ab4c257465ec046ea0

Download Submit
C:\Windows\{952C8B3E-B28F-409a-B6D8-81A4EAF99F65}.exe

Filesize
90KB

MD5
e5c580931d5bf269f61eca18a1b9b145

SHA1
80ba5c0c790bc634c9977fbcd618855f7bc7c58b

SHA256
7a749114d3c89395559725eb71262e4209f7c8b91fda678dcfff241d256ad8b5

SHA512
907fe7ecb959fe409101aaf88395283f783f32beb792af1cc8c3ee5f5ba226e493bbeb78c400d7546d43decb4a3daa540f94e594a3b8c9c4deaf051a74a894ca

Download Submit
C:\Windows\{978449AB-59B6-4728-8224-8C093FC4AE0B}.exe

Filesize
90KB

MD5
c523da647516506758016b3125db36c0

SHA1
5dbe8b3538f3ca1b6648439190d53761b071f1e9

SHA256
78c32e72192307aef4e590b572d526c381632b82353b3ea8d43fd2450474c280

SHA512
4a62cee6d88818b9e00b6771834d8c64ee97cf42cb7c70d45826c8b147f40271eb71c665452819508711b40627364e3ca3e689a4cf7f01d435bb18a8fd9808ae

Download Submit
C:\Windows\{BF77C2A2-D3A2-4315-B577-BFB751071011}.exe

Filesize
90KB

MD5
24aa932283d986de7ac91419e9b039d2

SHA1
49409b34789e2191d4086c0d79b3539066c47602

SHA256
2b51b1689ba6af6760f8c0f31b7a3ff023dbfd2221fa8c56890f2b3f4d00e505

SHA512
da969c017c69c81267338e6bd94e177ab7a40d0946eb1528a2e9e07b21e1122f5c058c51cb178be75186ff258fafc9a5d440c140d826c13cf3683846a56f016f

Download Submit
C:\Windows\{DEB99764-C2D1-4fe5-8A71-8FB38DA5490E}.exe

Filesize
90KB

MD5
4e8c62f8047838a669a86ffb6041b422

SHA1
3d0c937174e612e4b238c44cce262d76a987870e

SHA256
40289ff2c8da99bae2b639b12d186af8e23caf61a5c861f972fc3d02752c177a

SHA512
b5c39f5d5ea402d44381d5dad41efe6042d38396a611404e491392e9a75ab5fe90eb8ce7bcc7c470af6085dcdbdbd472c6c4ff2eed83a9f3abe319aa83f28df4

Download Submit
C:\Windows\{E070B2A8-36BA-45da-BAD9-F29540CB0F59}.exe

Filesize
90KB

MD5
3ad723046f0980940d9cec40ad90a3a0

SHA1
57f82d4f365f420e536494d5b81fd2d32a4ec5e9

SHA256
78b49340c1e3f85e76ed49a778bf09dc45ff59dde571848fca4f31ead0181593

SHA512
7aeca8bed04672d92cd68b9201c26da493bd9c0674e627f57e4e4db88585feef24c22efed00e3a71a91577b9538a883a0671547de5c55f813eaf15f7579fe532

Download Submit
C:\Windows\{EC34B392-A249-481e-95AA-27E953AB1030}.exe

Filesize
90KB

MD5
ec5c6ae2014a4f6aab95416cf3377807

SHA1
a287a6aea657d19e167c762178f6a1ab46115344

SHA256
6e9e76da8024423ae3d39c2bbaa6e14acbe9dd2055b95530fba173a5b358f055

SHA512
9a6c6ad6544818d3a8e6d968435dbde97d603ce2be68e21d45cfea09ddc59847286049e97da8ed3a2959347ad6391db794d0dd0f61e1e1ae114ae4bc57455d13

Download Submit
C:\Windows\{F4683618-36FD-4168-9A58-327220C2749C}.exe

Filesize
90KB

MD5
3ae9d0cec0fa8042dc4bacb37bba7339

SHA1
b980175cb49614400994a684cb630277888e68a4

SHA256
7b0a755578253749e02d3130672fad75bbcf2111e4913c681f672f80b20d24fa

SHA512
d937b2e1b1998228b7f221063965321b901d2c0db89dfe2c34b02a9fa165de3d2b841669faeb5c1cb4066f586bb58ac74371e43611dcf217ae67e5184e2051f1

Download Submit
C:\Windows\{F925BBA1-BDC8-4a8c-9659-B63EB08C303A}.exe

Filesize
90KB

MD5
b931ee54754bc70d1d79d1b92ec3e95c

SHA1
4644e29a75f2e325b9b26f919cf598019e394fac

SHA256
7c1b3b466b4653abfff7f393ae30f6df2678620fe94595f8acbe947beb0f7b94

SHA512
238049f53bccdf931a6e65f5eaecc2855ba051412edcf41cf3e300bf0cf883d29a1f61b9f3b70c7d5d72dd8daf2c3ad4d27fa0c0b73db13c1d09e4d195484736

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads