081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe
Size 92KB
Sample240502-w2ymvadf8t
SHA256 081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a
MD5 8e59de85a6e18ec0258d1aa3b1983931
SHA1 dad262cd0fcab37af5d306bb7d63047500f00f05
SHA512 6541593cff011538500fa6d6b8d42d0964dd6b517a75b46fcb496f89c512e26a86674760d673dba414f2f7a0fac7471c629a9be0626a830df9d713b449447827
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwZY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLror4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D5A645E-CA38-480d-9135-AB775AC6A27F}	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D5A645E-CA38-480d-9135-AB775AC6A27F}\stubpath = "C:\\Windows\\{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe"	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70262180-0781-4564-B847-A9505BD2FC8E}\stubpath = "C:\\Windows\\{70262180-0781-4564-B847-A9505BD2FC8E}.exe"	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}	{70262180-0781-4564-B847-A9505BD2FC8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}\stubpath = "C:\\Windows\\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe"	{70262180-0781-4564-B847-A9505BD2FC8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C83471F-C4DF-4d44-B564-BB7028F798C8}	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}	{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}\stubpath = "C:\\Windows\\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe"	{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C83471F-C4DF-4d44-B564-BB7028F798C8}\stubpath = "C:\\Windows\\{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe"	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70262180-0781-4564-B847-A9505BD2FC8E}	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A191788-39AF-467e-8AEE-A824479A1DBF}	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}\stubpath = "C:\\Windows\\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe"	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA336156-A12F-4cad-92F5-43B4BE9F0788}\stubpath = "C:\\Windows\\{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe"	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}\stubpath = "C:\\Windows\\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe"	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E3438B-8C26-4311-84E8-AAB9B687D875}\stubpath = "C:\\Windows\\{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe"	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}\stubpath = "C:\\Windows\\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe"	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}\stubpath = "C:\\Windows\\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe"	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A191788-39AF-467e-8AEE-A824479A1DBF}\stubpath = "C:\\Windows\\{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe"	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA336156-A12F-4cad-92F5-43B4BE9F0788}	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E3438B-8C26-4311-84E8-AAB9B687D875}	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe

Executes dropped EXE 12 IoCs

pid	Process
1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe
2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
2000	{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
2964	{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
File created	C:\Windows\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe
File created	C:\Windows\{70262180-0781-4564-B847-A9505BD2FC8E}.exe	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
File created	C:\Windows\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
File created	C:\Windows\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
File created	C:\Windows\{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
File created	C:\Windows\{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
File created	C:\Windows\{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
File created	C:\Windows\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe	{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
File created	C:\Windows\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
File created	C:\Windows\{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
File created	C:\Windows\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	{70262180-0781-4564-B847-A9505BD2FC8E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe
Token: SeIncBasePriorityPrivilege	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
Token: SeIncBasePriorityPrivilege	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
Token: SeIncBasePriorityPrivilege	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
Token: SeIncBasePriorityPrivilege	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe
Token: SeIncBasePriorityPrivilege	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
Token: SeIncBasePriorityPrivilege	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
Token: SeIncBasePriorityPrivilege	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
Token: SeIncBasePriorityPrivilege	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
Token: SeIncBasePriorityPrivilege	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
Token: SeIncBasePriorityPrivilege	1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
Token: SeIncBasePriorityPrivilege	2000	{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1356	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	97
PID 4500 wrote to memory of 1356	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	97
PID 4500 wrote to memory of 1356	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	97
PID 4500 wrote to memory of 3388	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	98
PID 4500 wrote to memory of 3388	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	98
PID 4500 wrote to memory of 3388	4500	081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe	98
PID 1356 wrote to memory of 5060	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	100
PID 1356 wrote to memory of 5060	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	100
PID 1356 wrote to memory of 5060	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	100
PID 1356 wrote to memory of 1096	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	101
PID 1356 wrote to memory of 1096	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	101
PID 1356 wrote to memory of 1096	1356	{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe	101
PID 5060 wrote to memory of 1880	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	104
PID 5060 wrote to memory of 1880	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	104
PID 5060 wrote to memory of 1880	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	104
PID 5060 wrote to memory of 3408	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	105
PID 5060 wrote to memory of 3408	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	105
PID 5060 wrote to memory of 3408	5060	{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe	105
PID 1880 wrote to memory of 844	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	106
PID 1880 wrote to memory of 844	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	106
PID 1880 wrote to memory of 844	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	106
PID 1880 wrote to memory of 3096	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	107
PID 1880 wrote to memory of 3096	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	107
PID 1880 wrote to memory of 3096	1880	{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe	107
PID 844 wrote to memory of 2576	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	108
PID 844 wrote to memory of 2576	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	108
PID 844 wrote to memory of 2576	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	108
PID 844 wrote to memory of 1020	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	109
PID 844 wrote to memory of 1020	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	109
PID 844 wrote to memory of 1020	844	{70262180-0781-4564-B847-A9505BD2FC8E}.exe	109
PID 2576 wrote to memory of 4848	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	114
PID 2576 wrote to memory of 4848	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	114
PID 2576 wrote to memory of 4848	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	114
PID 2576 wrote to memory of 2544	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	115
PID 2576 wrote to memory of 2544	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	115
PID 2576 wrote to memory of 2544	2576	{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe	115
PID 4848 wrote to memory of 1996	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	116
PID 4848 wrote to memory of 1996	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	116
PID 4848 wrote to memory of 1996	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	116
PID 4848 wrote to memory of 4820	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	117
PID 4848 wrote to memory of 4820	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	117
PID 4848 wrote to memory of 4820	4848	{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe	117
PID 1996 wrote to memory of 2512	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	120
PID 1996 wrote to memory of 2512	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	120
PID 1996 wrote to memory of 2512	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	120
PID 1996 wrote to memory of 4328	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	121
PID 1996 wrote to memory of 4328	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	121
PID 1996 wrote to memory of 4328	1996	{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe	121
PID 2512 wrote to memory of 3272	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	127
PID 2512 wrote to memory of 3272	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	127
PID 2512 wrote to memory of 3272	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	127
PID 2512 wrote to memory of 4960	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	128
PID 2512 wrote to memory of 4960	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	128
PID 2512 wrote to memory of 4960	2512	{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe	128
PID 3272 wrote to memory of 1692	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	129
PID 3272 wrote to memory of 1692	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	129
PID 3272 wrote to memory of 1692	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	129
PID 3272 wrote to memory of 4608	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	130
PID 3272 wrote to memory of 4608	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	130
PID 3272 wrote to memory of 4608	3272	{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe	130
PID 1692 wrote to memory of 2000	1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe	131
PID 1692 wrote to memory of 2000	1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe	131
PID 1692 wrote to memory of 2000	1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe	131
PID 1692 wrote to memory of 816	1692	{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe	132

C:\Users\Admin\AppData\Local\Temp\081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe
"C:\Users\Admin\AppData\Local\Temp\081ef895601ad7f2ecb52e6bfafe819bb33dc6cb8c9dca3f705c8816ac69297a.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
  C:\Windows\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
    C:\Windows\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
      C:\Windows\{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\{70262180-0781-4564-B847-A9505BD2FC8E}.exe
        
        C:\Windows\{70262180-0781-4564-B847-A9505BD2FC8E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
        
        C:\Windows\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
        
        C:\Windows\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
        
        C:\Windows\{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
        
        C:\Windows\{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
        
        C:\Windows\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
        
        C:\Windows\{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
        
        C:\Windows\{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
        
        C:\Windows\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe
        
        C:\Windows\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe
        13⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E3E34~1.EXE > nul
        13⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA336~1.EXE > nul
        12⤵
        
        PID:816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED2F8~1.EXE > nul
        11⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A191~1.EXE > nul
        10⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C834~1.EXE > nul
        9⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16BC3~1.EXE > nul
        8⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21FF7~1.EXE > nul
        7⤵
        
        PID:2544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70262~1.EXE > nul
        6⤵
        
        PID:1020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D5A6~1.EXE > nul
        5⤵
        
        PID:3096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D5728~1.EXE > nul
      4⤵
      PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{262F0~1.EXE > nul
    3⤵
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\081EF8~1.EXE > nul
  2⤵
  PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe

Path C:\Windows\{0D5A645E-CA38-480d-9135-AB775AC6A27F}.exe
Size 92KB
SHA256 82c8d9719a794e0f856a8b09f3312dff93137a35cee32f7abe6352fab4931b12
MD5 562f11a1ecfa345da27b608d9105a659
SHA1 496a7efc4702759393312c5e36e7b1d5ad6f27f6
SHA512 37add2e0b72350f51ba1f33b7fb97e7aa9b020eefc94dfc03c00728eda751c0f9a0aa59bf28325eb91cbc3cda740db3084bd3bdee7eeb43828a2a5517181a8b4
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwYuY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroN4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe

Path C:\Windows\{16BC3D83-F25C-4eb9-88D4-523D515CBA65}.exe
Size 92KB
SHA256 7fd3dfdfcb2f3f9ccd452cfb0c1a90e95fee1475bdd4010b30044ec297250b14
MD5 cb1dd11cfbe94cd9b018c039fe7a9561
SHA1 6dafaf9e6c41dcdf83b0106d77e05a42ef8f11e6
SHA512 0e8228c6dfca707c7bf2a27deb36b71daa3690ef88fe0164c3c1f5d8874eed89a92334736f04ec5ad1a4206d412ed16e4cc22826a6425a4c1bfff204b946b138
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwWY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroc4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe

Path C:\Windows\{21FF7F98-603B-4102-8AD4-F0044E8B9ED3}.exe
Size 92KB
SHA256 5e770e87b61916126681a92133f9dce643792f451edf18d4f53ad24bab718b44
MD5 a99986f3dcf5efbd0a52cc44fe335640
SHA1 9fd8bac8c8a0dd632d2c9eb488455739861b995a
SHA512 29bb1125b4d521fe166e12653c14daffd47dd0898414aea16009e3f7bb683bd409b093a90a3eb272ff9cb34ffa9417ee5bea069d10d5b9feaf11b28a83ad9f1b
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwEBY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLro+4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe

Path C:\Windows\{262F0FAE-EFE9-4525-A825-2ABDD7C794D4}.exe
Size 92KB
SHA256 6b6c094985a1bc1a256c627410ca0bfdbd757b5388b4862356d53909b2aca0f3
MD5 c3477a9d099692cec6df387afbaab324
SHA1 50f224724b21574ee5470012e2b1c1d15748158b
SHA512 0705de934d26bc665bd29ecd8bed5770480f261200c078af4aef63503fe8fa91c46542d09e7f6fc97ba5811624f7e1dc9abf369efe205ff64c088fd42189c614
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwEK6Y04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroO4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{70262180-0781-4564-B847-A9505BD2FC8E}.exe

Path C:\Windows\{70262180-0781-4564-B847-A9505BD2FC8E}.exe
Size 92KB
SHA256 fec80b05291b6a4065810d8068fc26253126179456855fd6bd8d84a5b4fedb7d
MD5 5e84ce9154024d14ac5735b771c89320
SHA1 2855839d6b93b0276a700fe514ec741e8d1176df
SHA512 b352b7ee9e39d5184c804e26c89d8ffe3cc20a1b013a715929ac0642b4ebb6e121dd27fcbbe25e7e237625949e7291aca794570cee6d84328d27fc53b9587e58
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwyY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroI4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe

Path C:\Windows\{7A191788-39AF-467e-8AEE-A824479A1DBF}.exe
Size 92KB
SHA256 7f27f9cf9dd68820ec7d9fb0b465dee728a2ef06e5eaa5f828b91c06d16f2769
MD5 dabc8e19d87191feac62459682666962
SHA1 ea78a45b8e5befb311ea659b9a4c120e6290cd72
SHA512 d40e0d2fe31b3e2420200c9e39e904741939e3ceccdaac9838bb5d46d6df43f842ae1a9b537fd969544b3c41599e71d135253b4d087fc0778be9fa7c5f03798c
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwRY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroj4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe

Path C:\Windows\{7C83471F-C4DF-4d44-B564-BB7028F798C8}.exe
Size 92KB
SHA256 6c6f35de8b671d85bcafd4548e21529a2e8d23065f15c700365d05e1a93eaf28
MD5 88963df269cf10bc01c01209b9461f66
SHA1 6fbef07ee83facc2cfcc3c62a68e4b142dd42e91
SHA512 923225d048b8c5770fa0fe3d61589003916ecd97cfa712251d4338f492a0fb5297dc7fe140965a80edcb7f88882baf9e0287cff825b3b56593a3b9995832b874
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqw1Y04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroH4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe

Path C:\Windows\{CA336156-A12F-4cad-92F5-43B4BE9F0788}.exe
Size 92KB
SHA256 d4df088795ed3de339fea334653cb2c45e39f5df8db2c95982c5a7bed8267b4a
MD5 a0e0e824568e5b0996de530cee6c6a20
SHA1 ab30ba6357e1aa0670e8c013021d865589b037aa
SHA512 f2d00080638f81c2a372eb902425a6d12b76ab0f77b316d1b61b4e3121773f75322a3d804a82ffb6d2239b7eacdf474b3698587cf6dfb691b22953f66ad958dd
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwoXY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroe4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe

Path C:\Windows\{D5728AB5-8876-48c7-BC73-1AAC5B79AF86}.exe
Size 92KB
SHA256 79f500a93984c56e360f6adb4a931c9195d8cf3853438b7bfcb8752e02c568fa
MD5 4e333cfe98fa0be08bc0f2682c2c0a6f
SHA1 87c9ff3ffef6072fa1550cdab8e42e02028ac2cb
SHA512 10484282575f66a8f726f3524ff6ff825fc804bdc1d320b453d65ff043c530ad5ab35ae2e988f3cacbe7be8d631d15b77229c025b7735dfed4636fab5dcccd97
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqw6Y04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLrow4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe

Path C:\Windows\{E3E3438B-8C26-4311-84E8-AAB9B687D875}.exe
Size 92KB
SHA256 31a1f55dd45b1de2230dd96fa139bf83e01cb34cb2e2d137d4dd01424ee41ff8
MD5 f363b8306128367c9a1240b41a6cf262
SHA1 91251d6becc4e057b89b7ef9ced736886173abe6
SHA512 850265ccec23ff5e5a0c305f8cead3872bb2004d8ba238b5f1c0abf7062d85aca8b1e190bd2bf521cb0548b085d7381c5834d97fe176efdbbb478661e56773a7
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwp0Y04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroc4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe

Path C:\Windows\{ED2F8B94-EC8D-4c48-B81E-1DFEFDF18096}.exe
Size 92KB
SHA256 4d205c5673e978c4160ef53e183bdbd6981372014bf6840a033666fe4d9e7d7e
MD5 f2f82cb5c64492034e4067c468ef1cfc
SHA1 16b25a9bb3b2116764bcdbc12bba606ec1635506
SHA512 d2223e66e5766d9be7b3ab0671b7dfc5b8cf76aae7eefc5e5428a3f3d85c2ca123508ec94748a7150217eaaa47b1b9cc3bc60afa3a16b75949239d8388a8009d
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqw5Y04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLroL4/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe

Path C:\Windows\{EE296A46-3B0D-40aa-AB2A-F90BFCAB85B8}.exe
Size 92KB
SHA256 95c1e97ed9e408128f34a657d6ebe02f0f5ca88c6a14f06cd38393a50ead657f
MD5 1bf723d6dc04998940e03b590f75da1f
SHA1 cb73616f793c472530cd2828fabdf5c28caacdc0
SHA512 db6ffb87c0fb90501ea7dbbe8d29f23e5031d929c92a02b71ff04595e3ec48892e306ec6ef31633fb346c3f815574db4be86e52074bfd65bd547e3e4026e5350
SSDEEP 192:ubOzawOs81elJHsc45gcRZOptShcWaOT2QLrCqwnHY04/CFxyNhoy5tX:ubLwOs8AHsc4qMewhKQLron54/CFsrdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-24-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/844-28-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1356-10-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1356-6-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1692-61-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1692-57-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1880-23-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1880-18-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1996-40-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1996-44-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2000-62-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2000-67-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2512-49-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2576-33-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2964-68-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3272-50-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3272-55-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4500-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4500-5-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4848-39-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5060-16-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5060-12-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads