afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
Size

213KB
MD5

cbe810f442b53955e5f5e03394166677
SHA1

604b9a3cbdb81ae63079a7474297c0654107d7e0
SHA256

afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c
SHA512

7bdf9988ab91f0a31a0ce5a9744520f36d08db17bf4af252a14f2a06a7a7a28caa34daf52f2cde0bb19035960f76be060f963801675e125df5187a354a6ca370
SSDEEP

1536:YEGh0oIl2unMxVS3HgdoKjhLJhzrryLPAneS3DquFSS4efk6kF/y+Ic7e/FtPt+A:YEGh0oIlvMUyNjhLJhXrhnJ3D4IF

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33BB423D-443B-464f-858F-CCC7B6C278E2}\stubpath = "C:\\Windows\\{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe"	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}\stubpath = "C:\\Windows\\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe"	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CE953D1-BD51-49a8-A2ED-645263A3F364}\stubpath = "C:\\Windows\\{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe"	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89D879FE-1D0F-4837-8B57-A8872EAAB354}	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}\stubpath = "C:\\Windows\\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe"	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D78508D-C976-4533-B979-8509BC0BB99B}	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D78508D-C976-4533-B979-8509BC0BB99B}\stubpath = "C:\\Windows\\{0D78508D-C976-4533-B979-8509BC0BB99B}.exe"	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D9DBA81-3308-4df3-827F-5FB654F3D983}\stubpath = "C:\\Windows\\{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe"	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}	{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}\stubpath = "C:\\Windows\\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe"	{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}\stubpath = "C:\\Windows\\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe"	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33BB423D-443B-464f-858F-CCC7B6C278E2}	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CE953D1-BD51-49a8-A2ED-645263A3F364}	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}\stubpath = "C:\\Windows\\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe"	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}\stubpath = "C:\\Windows\\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe"	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89D879FE-1D0F-4837-8B57-A8872EAAB354}\stubpath = "C:\\Windows\\{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe"	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}\stubpath = "C:\\Windows\\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe"	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D9DBA81-3308-4df3-827F-5FB654F3D983}	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe

Executes dropped EXE 12 IoCs

pid	Process
2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
2140	{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
4136	{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
File created	C:\Windows\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
File created	C:\Windows\{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
File created	C:\Windows\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
File created	C:\Windows\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe	{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
File created	C:\Windows\{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
File created	C:\Windows\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
File created	C:\Windows\{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
File created	C:\Windows\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
File created	C:\Windows\{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
File created	C:\Windows\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
File created	C:\Windows\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
Token: SeIncBasePriorityPrivilege	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
Token: SeIncBasePriorityPrivilege	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
Token: SeIncBasePriorityPrivilege	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
Token: SeIncBasePriorityPrivilege	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
Token: SeIncBasePriorityPrivilege	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
Token: SeIncBasePriorityPrivilege	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
Token: SeIncBasePriorityPrivilege	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
Token: SeIncBasePriorityPrivilege	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
Token: SeIncBasePriorityPrivilege	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
Token: SeIncBasePriorityPrivilege	1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
Token: SeIncBasePriorityPrivilege	2140	{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2204	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	94
PID 1884 wrote to memory of 2204	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	94
PID 1884 wrote to memory of 2204	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	94
PID 1884 wrote to memory of 116	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	95
PID 1884 wrote to memory of 116	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	95
PID 1884 wrote to memory of 116	1884	afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe	95
PID 2204 wrote to memory of 1824	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	96
PID 2204 wrote to memory of 1824	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	96
PID 2204 wrote to memory of 1824	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	96
PID 2204 wrote to memory of 3208	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	97
PID 2204 wrote to memory of 3208	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	97
PID 2204 wrote to memory of 3208	2204	{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe	97
PID 1824 wrote to memory of 2508	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	99
PID 1824 wrote to memory of 2508	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	99
PID 1824 wrote to memory of 2508	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	99
PID 1824 wrote to memory of 5044	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	100
PID 1824 wrote to memory of 5044	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	100
PID 1824 wrote to memory of 5044	1824	{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe	100
PID 2508 wrote to memory of 2036	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	101
PID 2508 wrote to memory of 2036	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	101
PID 2508 wrote to memory of 2036	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	101
PID 2508 wrote to memory of 3096	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	102
PID 2508 wrote to memory of 3096	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	102
PID 2508 wrote to memory of 3096	2508	{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe	102
PID 2036 wrote to memory of 756	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	103
PID 2036 wrote to memory of 756	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	103
PID 2036 wrote to memory of 756	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	103
PID 2036 wrote to memory of 3228	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	104
PID 2036 wrote to memory of 3228	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	104
PID 2036 wrote to memory of 3228	2036	{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe	104
PID 756 wrote to memory of 1396	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	105
PID 756 wrote to memory of 1396	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	105
PID 756 wrote to memory of 1396	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	105
PID 756 wrote to memory of 5092	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	106
PID 756 wrote to memory of 5092	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	106
PID 756 wrote to memory of 5092	756	{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe	106
PID 1396 wrote to memory of 4004	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	107
PID 1396 wrote to memory of 4004	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	107
PID 1396 wrote to memory of 4004	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	107
PID 1396 wrote to memory of 4668	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	108
PID 1396 wrote to memory of 4668	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	108
PID 1396 wrote to memory of 4668	1396	{0D78508D-C976-4533-B979-8509BC0BB99B}.exe	108
PID 4004 wrote to memory of 1116	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	109
PID 4004 wrote to memory of 1116	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	109
PID 4004 wrote to memory of 1116	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	109
PID 4004 wrote to memory of 4372	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	110
PID 4004 wrote to memory of 4372	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	110
PID 4004 wrote to memory of 4372	4004	{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe	110
PID 1116 wrote to memory of 5032	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	111
PID 1116 wrote to memory of 5032	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	111
PID 1116 wrote to memory of 5032	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	111
PID 1116 wrote to memory of 1912	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	112
PID 1116 wrote to memory of 1912	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	112
PID 1116 wrote to memory of 1912	1116	{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe	112
PID 5032 wrote to memory of 1748	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	113
PID 5032 wrote to memory of 1748	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	113
PID 5032 wrote to memory of 1748	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	113
PID 5032 wrote to memory of 1896	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	114
PID 5032 wrote to memory of 1896	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	114
PID 5032 wrote to memory of 1896	5032	{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe	114
PID 1748 wrote to memory of 2140	1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe	115
PID 1748 wrote to memory of 2140	1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe	115
PID 1748 wrote to memory of 2140	1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe	115
PID 1748 wrote to memory of 2128	1748	{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe	116

C:\Users\Admin\AppData\Local\Temp\afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe
"C:\Users\Admin\AppData\Local\Temp\afbd70199058081340ac7b06e20490d4a8c7caf244de8840a106da8be8fafa9c.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
  C:\Windows\{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
    C:\Windows\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
      C:\Windows\{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
        
        C:\Windows\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Windows\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
        
        C:\Windows\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
        
        C:\Windows\{0D78508D-C976-4533-B979-8509BC0BB99B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
        
        C:\Windows\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
        
        C:\Windows\{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
        
        C:\Windows\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
        
        C:\Windows\{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
        
        C:\Windows\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe
        
        C:\Windows\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe
        13⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{08E92~1.EXE > nul
        13⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33BB4~1.EXE > nul
        12⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BE63B~1.EXE > nul
        11⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7D9DB~1.EXE > nul
        10⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA5D5~1.EXE > nul
        9⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D785~1.EXE > nul
        8⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8EF82~1.EXE > nul
        7⤵
        
        PID:5092
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{161DF~1.EXE > nul
        6⤵
        
        PID:3228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89D87~1.EXE > nul
        5⤵
        
        PID:3096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{795EA~1.EXE > nul
      4⤵
      PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1CE95~1.EXE > nul
    3⤵
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\AFBD70~1.EXE > nul
  2⤵
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe

Filesize
128KB

MD5
6ebf3ad373efa10549c588e439cb52c4

SHA1
70ca347377419e606b092cd43b22be463e56d44a

SHA256
a569592fd3e06cee8bc98f683e301843dbb68a5c87ca8e59ea5f907f0ef71786

SHA512
f6dc1bca007c50d2d5a1ccd70f3c914bbf8852a2ddb417e26af465be522d0cd31d551ea827ec34825fb6d89eea00581bdcb1fd3d353b8f2f68bd1b54368ee70f

Download Submit
C:\Windows\{08E9245E-B9B9-47b6-805F-9C50EEDEFCE0}.exe

Filesize
79KB

MD5
2cee938dc6690fd3b994bd3d8904fe1c

SHA1
f4770a6d89e1eff49f5cb2850bae26012f25b100

SHA256
7ba077544ffbdf6f60f2fce3ea3f6815b95eaaf47c6254925716ec7d80487c1c

SHA512
8f694cb0fe658b1b7cdfa1de32c2567e46873a6accd05f1eefd5441dc80820ef45ebadaf73889f25c8d673bc36b835fc7ff755c62b08c989722aedd784dbf4f7

Download Submit
C:\Windows\{0D78508D-C976-4533-B979-8509BC0BB99B}.exe

Filesize
213KB

MD5
ceb4d3df272995504e818517b855c558

SHA1
76b94ac7c28a5c1ee18a1e927e63a7736b60ed0d

SHA256
969c3a607694097859ca4bb072e5b58d2649b3b45ee412f861ada01bbefea9e9

SHA512
adbf6aa28829cc09edc3cd7cfad8b64c639c8a23b7665a32d85abb6b2c2d111f9e0077c1366dd3e1dfc877d79fc383cc1f88b141a53e4c88c76c3eed239bdb09

Download Submit
C:\Windows\{161DF36D-1F06-43b5-9F5F-61D73DAD0FBA}.exe

Filesize
213KB

MD5
337e8e7891e8a58a3639da7cb0710f43

SHA1
69f58d33c2f80e1bfb87f49aa81228707bb73cc1

SHA256
754336eda3d4977b8aee9798f018460b172371337ba8b11b04ebd2989cd84eac

SHA512
b65029b9835cfd3ff864755f14e2e6d229738ac7acd8d34bb476ca67bf10d69412f2e5572620547ad3879a0e98e8e9bdbc1081249fd47e88939d32f5370ff9ae

Download Submit
C:\Windows\{1CE953D1-BD51-49a8-A2ED-645263A3F364}.exe

Filesize
213KB

MD5
493057ec8cade9d249086ee199e225ae

SHA1
619e5bcf87cfed4f5946bbf82d6783e03c3ec475

SHA256
19710aeb28e2910d201671b2ccb91b48a26748f39e4001a7f270858ceace761b

SHA512
c1e5c0b8a8524c21252168df3793a96f6ee1ba1f3ea59667e7f0576af2556ad210d8c111c7618c353ff468b1075b7f763b05b919fcd82de91ac8d6aca9900e27

Download Submit
C:\Windows\{33BB423D-443B-464f-858F-CCC7B6C278E2}.exe

Filesize
213KB

MD5
1536d915146f0fc451cf0431f8c4c009

SHA1
5f3009f8a68d0d0e55965b87fc368f44d9dc2675

SHA256
cf8223e21bfde030c198129dcbaf8c0ab999786f8dd7c5bdda2e036f21661f34

SHA512
8e9dd825365d8e31ab3a4a10e43b8d9f70946d85d6a274c9281d6ace1d5b261623f8ef595e00eb927eae24ccaafc0b58511310850c0b84a356010e1c2bf8c0b3

Download Submit
C:\Windows\{628B6DA1-4CDE-450a-9D4C-E8745F87ADAC}.exe

Filesize
213KB

MD5
c675ce486b10dff344f1552370f0b6ea

SHA1
5b78af26f0c37b9262bfa4bccb86e26d4dac10c4

SHA256
8b61759066c5400aafcb0f8445a1601df2d7cb7e6e2631a7502ba13d6a48606d

SHA512
2fbcae467d6a098c01eacc5cf71988e35f983189e7f0e6d4062e294a2de0b52f04a2c2ebcbb854b92608152e43dce17754cfb3c62dbe17b3abecdb26d84857eb

Download Submit
C:\Windows\{795EAE9F-67DA-4f44-9CE8-5B7423868B80}.exe

Filesize
213KB

MD5
4d94ce42a5e71901699e0416e5eaf7e3

SHA1
5e0e99c29742cf1b109793a7d23eff2c563b1117

SHA256
65bdf8bbf1c84df6c0085f8acc63120ea8e71ec5cc1917d259072395d173a9a9

SHA512
adc50db56d64370e9427fd49965fff478a7d206b2136fe37a68479ae1089fc33f82218ad6a8d356c8075e37f32a6d928d954da6e75151f14e3de25a425f668e6

Download Submit
C:\Windows\{7D9DBA81-3308-4df3-827F-5FB654F3D983}.exe

Filesize
213KB

MD5
03584531eaf31edb92eb2a988959e6f8

SHA1
5e6390e050dea71ad062f4de4a9751b1ae4356c3

SHA256
f7e78d224a951ac0594f4ea6f0ba001c3a71231ee4458056c167c8f132819230

SHA512
dc47723da6cd88333727aae9bbd401a53cf208c5e96ff22ac9037f5f0318669787de680fd19c5d91642a4e604e6aca9ed64f39db7a2fa8ee07b4c0fbf94d8b17

Download Submit
C:\Windows\{89D879FE-1D0F-4837-8B57-A8872EAAB354}.exe

Filesize
213KB

MD5
2f088c1c285f391c3669bf6e0c2ac78e

SHA1
249f255e2b02881dfcdd90321480a61d682b4ca1

SHA256
c5308ae1889046a9c62ce056abcc7df4ddaa774a087ae6e319dc29f4103f4391

SHA512
1d4a2e1786f176e9ee073d081381dffcee504face0b6d44d6f26b1d0658e8fb97914dd4cc23f0642374304eac5982cf96737642373aa194951b1b2c3a6e1b2a4

Download Submit
C:\Windows\{8EF8208C-AC47-4561-B19C-A2988DF0CC3A}.exe

Filesize
213KB

MD5
7c099fea533dac6eb964345e96ba5c09

SHA1
20e4d4a42988c12482e16e54f88caf8f8353b29d

SHA256
de4dc60553a2038615db40c4629b5ff22d963b873ed2c0690033b4f2cd690662

SHA512
b2ed8130d3e05d980dc083c61d7afaf8783ae54de86d505ddac3388511889cfc15abcc6bceef93d385bfe70f9b2bfc1e0f4dd2ee01a5d9285efdea61c9ea4989

Download Submit
C:\Windows\{BE63B7F1-C712-4f13-9305-8A97EF1897A6}.exe

Filesize
213KB

MD5
80c6841838148e0aafe89ed81059a6a7

SHA1
265b3e9ab1e955ec019bcb495ca3ca333cf7b7f5

SHA256
b683d89a309d3650122ce3748b611d8f84d4292f94c5a1bcd2da0dbe82de52e2

SHA512
355a38338c7f2dcaec1779afa3ff810eb23c3dc21b6ad3d2235d1fcf4b51e42087cd1e7e47a961cef8ad870e512fb23bfe2ec1ad524973882b5a521a7570d77b

Download Submit
C:\Windows\{EA5D5A3E-4B25-4cf5-89BD-AE3B3899225A}.exe

Filesize
213KB

MD5
e4c22176a833d8e7258afb00bb579dad

SHA1
39185fe89ff1dbb498ba288cfb4776143cb7efe4

SHA256
2d153a07f31cacaca7f4879b34592aa4dd11e9c322127dea8267e66571ac4ed8

SHA512
7049f749114e1971e3d2ac2c4f29c8efb5b9a1e987ae84b5fac141d507b7cd84f9db0e4b8477e23c0409b8a5fe8bdc4b263f7af84630b6d915ed913df346a9ef

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads