93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386

Analysis

max time kernel
113s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe
Size 324KB
Sample240404-21kmgsch3t
SHA256 93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386
MD5 24193f8e14a7e57d6e877a88a6e99380
SHA1 dbfc1af9f75d5cb6285c3c93474f64358d56e1ca
SHA512 ab50eb655b2c096637f3d2d70e108cac489f3395f6a1b78d5588f6999bccb889e0cde74246d93c937cdeff7486e4bbdfdafec03cb0167ad587c5de114a819ba1
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sXnzQI6F3:2tXMzqrllX73wAEI6V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3336	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
492	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
1752	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
4624	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
4880	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
2152	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
3300	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
4740	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
700	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
4872	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
3124	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
840	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
3976	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
1288	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
2460	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
4060	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe
4308	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
2732	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe
3160	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
4600	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
952	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
492	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
1580	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
4076	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
688	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
3308	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x00030000000227e7-5.dat	upx
behavioral2/memory/3336-9-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4852-10-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3336-18-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0004000000022ea3-26.dat	upx
behavioral2/memory/1752-34-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4624-38-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/492-28-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4624-47-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4880-48-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4880-58-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2152-57-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2152-65-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3300-76-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x000700000002324d-83.dat	upx
behavioral2/memory/700-91-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/700-96-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4872-94-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4740-84-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3124-106-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4872-105-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1752-123-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3976-124-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3976-132-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/840-130-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1288-135-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1288-143-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2460-153-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0007000000023256-160.dat	upx
behavioral2/memory/4308-161-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4060-163-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4308-170-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/2732-179-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3160-182-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3160-191-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/952-201-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0004000000022d20-208.dat	upx
behavioral2/memory/492-210-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/952-209-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4600-200-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/492-219-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1580-230-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1580-221-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4076-239-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/688-247-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3308-249-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 58c83ad33900de58	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3336	4852	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe	95
PID 4852 wrote to memory of 3336	4852	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe	95
PID 4852 wrote to memory of 3336	4852	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe	95
PID 3336 wrote to memory of 492	3336	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe	96
PID 3336 wrote to memory of 492	3336	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe	96
PID 3336 wrote to memory of 492	3336	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe	96
PID 492 wrote to memory of 1752	492	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe	97
PID 492 wrote to memory of 1752	492	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe	97
PID 492 wrote to memory of 1752	492	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe	97
PID 1752 wrote to memory of 4624	1752	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe	98
PID 1752 wrote to memory of 4624	1752	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe	98
PID 1752 wrote to memory of 4624	1752	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe	98
PID 4624 wrote to memory of 4880	4624	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe	99
PID 4624 wrote to memory of 4880	4624	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe	99
PID 4624 wrote to memory of 4880	4624	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe	99
PID 4880 wrote to memory of 2152	4880	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe	100
PID 4880 wrote to memory of 2152	4880	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe	100
PID 4880 wrote to memory of 2152	4880	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe	100
PID 2152 wrote to memory of 3300	2152	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe	101
PID 2152 wrote to memory of 3300	2152	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe	101
PID 2152 wrote to memory of 3300	2152	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe	101
PID 3300 wrote to memory of 4740	3300	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe	102
PID 3300 wrote to memory of 4740	3300	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe	102
PID 3300 wrote to memory of 4740	3300	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe	102
PID 4740 wrote to memory of 700	4740	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe	103
PID 4740 wrote to memory of 700	4740	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe	103
PID 4740 wrote to memory of 700	4740	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe	103
PID 700 wrote to memory of 4872	700	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe	104
PID 700 wrote to memory of 4872	700	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe	104
PID 700 wrote to memory of 4872	700	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe	104
PID 4872 wrote to memory of 3124	4872	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe	105
PID 4872 wrote to memory of 3124	4872	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe	105
PID 4872 wrote to memory of 3124	4872	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe	105
PID 3124 wrote to memory of 840	3124	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe	106
PID 3124 wrote to memory of 840	3124	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe	106
PID 3124 wrote to memory of 840	3124	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe	106
PID 840 wrote to memory of 3976	840	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe	107
PID 840 wrote to memory of 3976	840	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe	107
PID 840 wrote to memory of 3976	840	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe	107
PID 3976 wrote to memory of 1288	3976	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe	108
PID 3976 wrote to memory of 1288	3976	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe	108
PID 3976 wrote to memory of 1288	3976	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe	108
PID 1288 wrote to memory of 2460	1288	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe	109
PID 1288 wrote to memory of 2460	1288	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe	109
PID 1288 wrote to memory of 2460	1288	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe	109
PID 2460 wrote to memory of 4060	2460	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe	110
PID 2460 wrote to memory of 4060	2460	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe	110
PID 2460 wrote to memory of 4060	2460	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe	110
PID 4060 wrote to memory of 4308	4060	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe	111
PID 4060 wrote to memory of 4308	4060	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe	111
PID 4060 wrote to memory of 4308	4060	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe	111
PID 4308 wrote to memory of 2732	4308	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe	112
PID 4308 wrote to memory of 2732	4308	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe	112
PID 4308 wrote to memory of 2732	4308	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe	112
PID 2732 wrote to memory of 3160	2732	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe	113
PID 2732 wrote to memory of 3160	2732	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe	113
PID 2732 wrote to memory of 3160	2732	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe	113
PID 3160 wrote to memory of 4600	3160	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe	114
PID 3160 wrote to memory of 4600	3160	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe	114
PID 3160 wrote to memory of 4600	3160	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe	114
PID 4600 wrote to memory of 952	4600	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe	115
PID 4600 wrote to memory of 952	4600	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe	115
PID 4600 wrote to memory of 952	4600	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe	115
PID 952 wrote to memory of 492	952	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe	116

C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe
"C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4852
- \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
  c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3336
- - \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
    c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:492
  - - \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
      c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1752
    - - \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4624
      - \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:492
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1580
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4076
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:688
        
        \??\c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe
        
        c:\users\admin\appdata\local\temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe

Path C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
Size 324KB
SHA256 44ec6194eb1033a4bb805d81c197aa75e84fa5541ffc09eec1c72d668308f47b
MD5 b026d79d81c38f2fb33e81b3490ef2b3
SHA1 caab4d8c4ce122d74e35b6635275e67d2260cc68
SHA512 b385ed1acac653a4c87cc0739e91eba1fc6fe621185c35d7a3464900178255e9c378774c849ba3ba8d5ecec2b029a7797422a30549297bced4fe3c7ff4e9a8c8
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sXBzQI6F3:2tXMzqrllX73w+EI6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe

Path C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
Size 324KB
SHA256 7cd2eeb0b3ac11f12b7940a8ca50fc504b93b6db3080069b1ee6764a3bf25def
MD5 cb37e968e683142965c258c78d299b87
SHA1 8163d996c667040bdbda6a9c51c3f914395e0751
SHA512 c3310ac81bf228246801b771734b289ab54e87e49a34a2ab03f85c5628e3835b5ebbb4ae6635628a3a5260250dd37820c7f710bb03ce8f99e2948132f55627ac
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sXVzQI6F3:2tXMzqrllX73wqEI6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe

Path C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
Size 324KB
SHA256 864d3d62300aef6c33f12228a6409bb8b833c325b7d114e6d885dc672381cd14
MD5 6b78b949640846ee0efe2b4b88e83ce2
SHA1 443283cac600c3b423b46aec70364c503bbb4707
SHA512 5abd7ca9d7efabb9d782cace4591d05d5d3c7a1ec11bca878acad2234277027966bc40576d8428d9389ccc5893632064cfa2bc321614c60a555c6936cbe5fcec
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sX1zQI6F3:2tXMzqrllX73wmEI6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe

Path C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
Size 324KB
SHA256 3a6dc0ac3d598a430d59c038a1474aaf55e087b227a433379074d2b9d5d91abd
MD5 8e6db2d56617ffc56ca22516ddd3c3a9
SHA1 5140048e7baa209b553a005786e4449c67a0d52b
SHA512 78b2ca9ad4dd50e74c7d8479515db3e3d9c232cf592756163619a0661de0cb6cc110f2589b34fff3e4b4bee376af06edde2980d02a89817fb67f202e0df75dbf
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sXRzQI6F3:2tXMzqrllX73w6EI6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe

Path C:\Users\Admin\AppData\Local\Temp\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
Size 324KB
SHA256 dd38fef2c6b7b032346d9da4ff367d4398f59f21ef9a4bfaec777d54a403839e
MD5 dbd276208b6b2367b5187bd4dea87855
SHA1 72e63006aac54b79837f1eafaefe8ee32ce97226
SHA512 e3542e007a6e7ee225f909d9186d9fd697bc3bd89abe9197cab2a62355f537ac7af7e1370a8fe1b25612efd46b45cb2426bce494c7d296e444565747f06221a8
SSDEEP 6144:YhbZ5hMTNFf8LAurlEzAX7oEwfSZ4sXZzQI6F3:2tXMzqrllX73wuEI6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/492-28-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/492-219-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/492-210-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/688-247-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/700-96-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/700-91-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/840-130-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/952-201-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/952-209-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1288-143-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1288-135-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1580-221-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1580-230-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1752-34-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1752-123-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2152-65-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2152-57-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2460-153-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2732-179-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3124-106-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3160-182-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3160-191-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3300-76-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3308-249-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3336-18-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3336-9-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3976-132-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3976-124-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4060-163-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4076-239-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4308-161-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4308-170-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4600-200-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4624-47-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4624-38-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4740-84-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4852-10-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4872-94-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4872-105-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4880-48-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4880-58-0x0000000000400000-0x000000000043B000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202y.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202t.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202c.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202i.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202x.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202b.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202e.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202m.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202v.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202p.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202r.exe\""	93943585ee6d372b8e7c3a592ad4422c4a20e11de5d92e36db2658d1c707a386_3202q.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads