56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
Size

60KB
MD5

1c20614e88d7f0d2e5812a65da23449d
SHA1

6e6cbb864a31eb66fcd07732b158436afe96baf7
SHA256

56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534
SHA512

efd1fcb4867b45359a3d91b5fe74c572ea3ef671048917529ee24f43350b1bc56f2f954706cfad42067ade88f4235c74d3c00928c904c1076d1e84d1e1c01f8a
SSDEEP

384:vbLwOs8AHsc4sMfwhKQLroT4/CFsrdHWMZo:vvw9816vhKQLroT4/wQpWMZo

Score

9^/10

persistence

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 12 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023496-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000b00000002349b-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000002349f-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000002349b-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000f00000002349f-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000002349b-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000002349f-26.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000e00000002349b-30.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001100000002349f-35.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000f00000002349b-38.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001200000002349f-42.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x001000000002349b-46.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}\stubpath = "C:\\Windows\\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe"	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32297494-5451-4151-9DB8-72D94C48619C}	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}	{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32297494-5451-4151-9DB8-72D94C48619C}\stubpath = "C:\\Windows\\{32297494-5451-4151-9DB8-72D94C48619C}.exe"	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3850B08-35AD-4272-96EA-9295A7816F38}	{32297494-5451-4151-9DB8-72D94C48619C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{999F9A80-5A22-4758-BFE7-30E55D2279B2}\stubpath = "C:\\Windows\\{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe"	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E628543D-44B0-4771-9316-05A34D0CC5F9}\stubpath = "C:\\Windows\\{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe"	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}\stubpath = "C:\\Windows\\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe"	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A58D2144-3892-44cd-8C2E-7D822D07676A}\stubpath = "C:\\Windows\\{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe"	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}\stubpath = "C:\\Windows\\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe"	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{934FFACD-2F62-4a46-AA17-4A1416265F3E}\stubpath = "C:\\Windows\\{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe"	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3850B08-35AD-4272-96EA-9295A7816F38}\stubpath = "C:\\Windows\\{D3850B08-35AD-4272-96EA-9295A7816F38}.exe"	{32297494-5451-4151-9DB8-72D94C48619C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}\stubpath = "C:\\Windows\\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe"	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A58D2144-3892-44cd-8C2E-7D822D07676A}	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{934FFACD-2F62-4a46-AA17-4A1416265F3E}	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}\stubpath = "C:\\Windows\\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe"	{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E628543D-44B0-4771-9316-05A34D0CC5F9}	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{999F9A80-5A22-4758-BFE7-30E55D2279B2}	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}\stubpath = "C:\\Windows\\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe"	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe

Executes dropped EXE 12 IoCs

pid	Process
1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe
4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
4260	{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
3600	{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
File created	C:\Windows\{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
File created	C:\Windows\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
File created	C:\Windows\{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
File created	C:\Windows\{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	{32297494-5451-4151-9DB8-72D94C48619C}.exe
File created	C:\Windows\{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
File created	C:\Windows\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
File created	C:\Windows\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe	{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
File created	C:\Windows\{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
File created	C:\Windows\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
File created	C:\Windows\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
File created	C:\Windows\{32297494-5451-4151-9DB8-72D94C48619C}.exe	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
Token: SeIncBasePriorityPrivilege	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
Token: SeIncBasePriorityPrivilege	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
Token: SeIncBasePriorityPrivilege	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
Token: SeIncBasePriorityPrivilege	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
Token: SeIncBasePriorityPrivilege	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
Token: SeIncBasePriorityPrivilege	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
Token: SeIncBasePriorityPrivilege	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
Token: SeIncBasePriorityPrivilege	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe
Token: SeIncBasePriorityPrivilege	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
Token: SeIncBasePriorityPrivilege	3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
Token: SeIncBasePriorityPrivilege	4260	{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1744	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	86
PID 4108 wrote to memory of 1744	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	86
PID 4108 wrote to memory of 1744	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	86
PID 4108 wrote to memory of 3996	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	87
PID 4108 wrote to memory of 3996	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	87
PID 4108 wrote to memory of 3996	4108	56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe	87
PID 1744 wrote to memory of 1648	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	88
PID 1744 wrote to memory of 1648	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	88
PID 1744 wrote to memory of 1648	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	88
PID 1744 wrote to memory of 1396	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	89
PID 1744 wrote to memory of 1396	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	89
PID 1744 wrote to memory of 1396	1744	{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe	89
PID 1648 wrote to memory of 4480	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	93
PID 1648 wrote to memory of 4480	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	93
PID 1648 wrote to memory of 4480	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	93
PID 1648 wrote to memory of 5012	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	94
PID 1648 wrote to memory of 5012	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	94
PID 1648 wrote to memory of 5012	1648	{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe	94
PID 4480 wrote to memory of 4960	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	95
PID 4480 wrote to memory of 4960	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	95
PID 4480 wrote to memory of 4960	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	95
PID 4480 wrote to memory of 764	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	96
PID 4480 wrote to memory of 764	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	96
PID 4480 wrote to memory of 764	4480	{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe	96
PID 4960 wrote to memory of 552	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	97
PID 4960 wrote to memory of 552	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	97
PID 4960 wrote to memory of 552	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	97
PID 4960 wrote to memory of 1444	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	98
PID 4960 wrote to memory of 1444	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	98
PID 4960 wrote to memory of 1444	4960	{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe	98
PID 552 wrote to memory of 4008	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	99
PID 552 wrote to memory of 4008	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	99
PID 552 wrote to memory of 4008	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	99
PID 552 wrote to memory of 568	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	100
PID 552 wrote to memory of 568	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	100
PID 552 wrote to memory of 568	552	{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe	100
PID 4008 wrote to memory of 4356	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	101
PID 4008 wrote to memory of 4356	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	101
PID 4008 wrote to memory of 4356	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	101
PID 4008 wrote to memory of 988	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	102
PID 4008 wrote to memory of 988	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	102
PID 4008 wrote to memory of 988	4008	{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe	102
PID 4356 wrote to memory of 3860	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	103
PID 4356 wrote to memory of 3860	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	103
PID 4356 wrote to memory of 3860	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	103
PID 4356 wrote to memory of 4956	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	104
PID 4356 wrote to memory of 4956	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	104
PID 4356 wrote to memory of 4956	4356	{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe	104
PID 3860 wrote to memory of 4328	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	105
PID 3860 wrote to memory of 4328	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	105
PID 3860 wrote to memory of 4328	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	105
PID 3860 wrote to memory of 4324	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	106
PID 3860 wrote to memory of 4324	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	106
PID 3860 wrote to memory of 4324	3860	{32297494-5451-4151-9DB8-72D94C48619C}.exe	106
PID 4328 wrote to memory of 3980	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	107
PID 4328 wrote to memory of 3980	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	107
PID 4328 wrote to memory of 3980	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	107
PID 4328 wrote to memory of 4592	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	108
PID 4328 wrote to memory of 4592	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	108
PID 4328 wrote to memory of 4592	4328	{D3850B08-35AD-4272-96EA-9295A7816F38}.exe	108
PID 3980 wrote to memory of 4260	3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe	109
PID 3980 wrote to memory of 4260	3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe	109
PID 3980 wrote to memory of 4260	3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe	109
PID 3980 wrote to memory of 4348	3980	{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe	110

C:\Users\Admin\AppData\Local\Temp\56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe
"C:\Users\Admin\AppData\Local\Temp\56f107a77c28967437c8362a451eaf74c5fcff0205fc694ccbfcad5afe54d534.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
  C:\Windows\{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
    C:\Windows\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
      C:\Windows\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
        
        C:\Windows\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Windows\{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
        
        C:\Windows\{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
        
        C:\Windows\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
        
        C:\Windows\{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\{32297494-5451-4151-9DB8-72D94C48619C}.exe
        
        C:\Windows\{32297494-5451-4151-9DB8-72D94C48619C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
        
        C:\Windows\{D3850B08-35AD-4272-96EA-9295A7816F38}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
        
        C:\Windows\{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
        
        C:\Windows\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
        
        C:\Windows\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe
        
        C:\Windows\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe
        13⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9019~1.EXE > nul
        13⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{999F9~1.EXE > nul
        12⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3850~1.EXE > nul
        11⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32297~1.EXE > nul
        10⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{934FF~1.EXE > nul
        9⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4BEAA~1.EXE > nul
        8⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A58D2~1.EXE > nul
        7⤵
        
        PID:568
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E0DF~1.EXE > nul
        6⤵
        
        PID:1444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93508~1.EXE > nul
        5⤵
        
        PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DEE4D~1.EXE > nul
      4⤵
      PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E6285~1.EXE > nul
    3⤵
    PID:1396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\56F107~1.EXE > nul
  2⤵
  PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{32297494-5451-4151-9DB8-72D94C48619C}.exe

Filesize
60KB

MD5
eb222abe7d6857a50d9c820323a863d8

SHA1
bd73470a6dcb9bbf63f8ba1832d13ba3a7b4920c

SHA256
3023ad6fc1efebe4efd514ec3012bc723e23e041c6031e2f63f1d55405f85f7d

SHA512
38da97465d75605604754d6029640b5acd92dbe4f47a9e683d0a3fe52f184f21f7eb98933f7ebfaff4c30e2513c58cc9dc57d3c137ad61dcb5ce85660176dcb5

Download Submit
C:\Windows\{4BEAAE87-1313-4655-A2B9-80A417E34DF8}.exe

Filesize
60KB

MD5
a75fdf6e99dbdc34d4b2c3c61552de0a

SHA1
d763903985b102670cc16001982d9845132c0964

SHA256
4910a81410c50c852521c998b2f0db51e500e0c6faf0718ac12339cb91cc4c95

SHA512
dbdd1e76f77cb4a511283e70cf1207bd8f83063298beaf3905411234f3838c14489220a4e39379d30777cf5c66af9051a33e0ec3dfa8ee525269be8535050c4c

Download Submit
C:\Windows\{6E0DFF42-93CD-41b5-8870-CB989BA3FD69}.exe

Filesize
60KB

MD5
3e9c4bb347100c0aec23ac83498ca190

SHA1
ece5c47ac2cbcb979cdff53ee9764c1f93793894

SHA256
8a4d776a66af1afc0afdb7cf0ffca7833253187de7b97d8ceb942c20677dac49

SHA512
d7ece51bb9d65baff13a9fe2f6c54489375646291d44b47e5f32dd0e9bf3d1e2480dfc8d3549ca6f379990fd91384b4e0633d3c1c65ae2c3d35a7a4f577d987d

Download Submit
C:\Windows\{934FFACD-2F62-4a46-AA17-4A1416265F3E}.exe

Filesize
60KB

MD5
ff4a3e6cbfb3c1ff80561e681fdf1c5c

SHA1
386c1dfd717dd691d6def4863eed7c9925cae742

SHA256
28da2dfa4671589bc635afb21988ecb8f364b5b88d8dd2bca474d526dc32699c

SHA512
606f49c0083bf26eafc8cf49e1471860363b76fd7e322ec02f370599b99b02399fd1d64a60134b28c5c69a85f3950a5ed16bd6638a5f3cd459461cd40e85e0ea

Download Submit
C:\Windows\{935084C4-50AF-4bf2-A59D-087BA31B7BE0}.exe

Filesize
60KB

MD5
688f3d4f580ae374c68961ce3932ad9f

SHA1
4106ec8e34c951d8da2e106212cfa4bde4624cff

SHA256
9352ce0327213ae31068ac64dc72262335b9b4f6baa713823eb2d1499eb4c146

SHA512
ee616854d61b4fc9a3b42d95a603470261c097ee65890c9d5a4459336b0708f9b526cd7f2a8bc3ae3d0a7560ed0fa6db20a1f39dbbbabec91cba2ae10db3d925

Download Submit
C:\Windows\{999F9A80-5A22-4758-BFE7-30E55D2279B2}.exe

Filesize
60KB

MD5
0ec85120b3428544c74b62ec3cdcf825

SHA1
e6b6b1295ad60d346421d9233205ce8ac4bb8604

SHA256
baf22c64e3034f36198be15393ef22d1d0432488dc64ad52d9a564928a12fd47

SHA512
21a4ad17a4a816feed655a178cf660eab1fcd811ec32bbfe669cf48f3b692ed1d0781e6461b78a4da2f6ef10d9489f2a0236a7df897e8df6c902d7690d33186d

Download Submit
C:\Windows\{A58D2144-3892-44cd-8C2E-7D822D07676A}.exe

Filesize
60KB

MD5
a4b9bc1224ee018eef0d9e92977344f5

SHA1
be50b126ad61dae50f41f59102920687fcc4b997

SHA256
0efa49cf63be9177fae14be4764fc8e7019490a17ec9e190eef824789418a886

SHA512
f07c7f71d0509e71be9b180c4e08e189ea64dcba19ce44df74045fa48e287b5925913dcf77dbec681371dc9294a090ff359425736385c2cb48edfbda05a12dc3

Download Submit
C:\Windows\{C9019B7C-9BDD-4272-A80B-F17DF040A9EF}.exe

Filesize
60KB

MD5
61119e030fe69262d2d56030aa46f764

SHA1
9551eda227b527f3beaa361201563a9a48df34de

SHA256
bdc5902de77ffc8041414e56ba401dd7174251074262001f6e7df160e6c33c11

SHA512
500b76efa6be9ed048e5d87f6586af033efc969c85be851c1d0a311a48b05cbf9f1d181414446000b653ccacfd4795dca38383ca05f93fc156a48021e47cc4ea

Download Submit
C:\Windows\{D3850B08-35AD-4272-96EA-9295A7816F38}.exe

Filesize
60KB

MD5
02dd21372253cccb049e100dc248c465

SHA1
a73ac64eaa3e470f1a7d70ab92aeec70b6d717bc

SHA256
84818bd1e51e1e30cd4c4ba9f71d739a371098d39ba15cce826e29d4e1c74817

SHA512
47db81232dc09c606c17835c1636a01e0571e581ae4f59dbea28114f1d113f38e9e5dda793a32e04aa64568ed29e1c05bbf8952b86e9bbacea948f9b1fb1c668

Download Submit
C:\Windows\{D6B623E8-42C4-41ab-BE79-0D6106F828B4}.exe

Filesize
60KB

MD5
aa977cc1f92440912a260ad3ad495011

SHA1
c4b339ad3aaa595caa51281932032903a19d9c35

SHA256
e5448d4f35acfaab765ffd1e51498093c9dc72e0382d4eeb6233c78edd4190b1

SHA512
37d48c21a76c33bb06fa520abe8448c445bef266666242a50794a75b89426db91182b45b8e4026b5dbf398719ce67d96855d4c4a973d3f53cf7ce4dedc00a639

Download Submit
C:\Windows\{DEE4DFF0-9CD4-4893-A365-7379DA42EF84}.exe

Filesize
60KB

MD5
8e73f9d915d78b2d8d9a3fe4cfe1f71b

SHA1
923d0692460598f1c5c0a55e28418706604c95b2

SHA256
a32714d3857548b1ddaac079b9e2dba6ca8285e2281eaf64b5eeecadfa1a3bbd

SHA512
a86c1dda54a818833731b447ff5a574017fdbb43747bc1ee2c6c1776f7112b6ef9d20fbca82e836fefb66fc459c9655534fa99ccb354a5f68820f2319f739d60

Download Submit
C:\Windows\{E628543D-44B0-4771-9316-05A34D0CC5F9}.exe

Filesize
60KB

MD5
8dd4c652b579c6d366be2fdb15dfef35

SHA1
d9d04d933cab9cf4bad13d89f0f60a3b20c3ae17

SHA256
a80e2e6c1e5676afe49ec13715f90707e5d921971904671ff166dbdbd1efc4ed

SHA512
cbe0b23eb543d3f3bdce8ccd53aedb73fcf678a0ae6606ec8fac060c0341950e0c70ef88f998d2454ce3c4a93dbaa018ffe8b46b06e10cc017fb9d4129f962f3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads