8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
Size

89KB
MD5

f170b5191fe2546e50d4467d6d1cab8d
SHA1

2f847cf224cee61f3f914bb4252295fa55179863
SHA256

8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279
SHA512

862b95d28a3f96ebb4db6f0fdefe0e8311443789f650f4b6d676382baabb63057e375996ad2477191c2d943fa4e011ea25d3f422541cab2a8232e12675a7b3d5
SSDEEP

768:Qvw9816vhKQLroH4/wQRNrfrunMxVFA3b7gl5:YEGh0oHl2unMxVS3HgX

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91DE92E2-71EE-421c-828D-BBD274054F48}	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61919B0C-E98D-4dfc-87ED-59075BFEE555}\stubpath = "C:\\Windows\\{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe"	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B675AFA0-6D2B-41d7-A006-053518885CD5}\stubpath = "C:\\Windows\\{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe"	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}\stubpath = "C:\\Windows\\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe"	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B675AFA0-6D2B-41d7-A006-053518885CD5}	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}\stubpath = "C:\\Windows\\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe"	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}\stubpath = "C:\\Windows\\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe"	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5465B85-3030-458d-AC02-4975FC9A33AE}	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01351A7A-47AE-400d-8F03-9B94565525C7}	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01351A7A-47AE-400d-8F03-9B94565525C7}\stubpath = "C:\\Windows\\{01351A7A-47AE-400d-8F03-9B94565525C7}.exe"	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5465B85-3030-458d-AC02-4975FC9A33AE}\stubpath = "C:\\Windows\\{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe"	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{607D90CA-401C-47a4-80D4-F17C838DBE2D}	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}\stubpath = "C:\\Windows\\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe"	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91DE92E2-71EE-421c-828D-BBD274054F48}\stubpath = "C:\\Windows\\{91DE92E2-71EE-421c-828D-BBD274054F48}.exe"	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61919B0C-E98D-4dfc-87ED-59075BFEE555}	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{607D90CA-401C-47a4-80D4-F17C838DBE2D}\stubpath = "C:\\Windows\\{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe"	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}\stubpath = "C:\\Windows\\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe"	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe

Executes dropped EXE 11 IoCs

pid	Process
3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
772	{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
File created	C:\Windows\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
File created	C:\Windows\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
File created	C:\Windows\{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
File created	C:\Windows\{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
File created	C:\Windows\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
File created	C:\Windows\{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
File created	C:\Windows\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
File created	C:\Windows\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
File created	C:\Windows\{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
File created	C:\Windows\{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
Token: SeIncBasePriorityPrivilege	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
Token: SeIncBasePriorityPrivilege	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
Token: SeIncBasePriorityPrivilege	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
Token: SeIncBasePriorityPrivilege	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
Token: SeIncBasePriorityPrivilege	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
Token: SeIncBasePriorityPrivilege	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
Token: SeIncBasePriorityPrivilege	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
Token: SeIncBasePriorityPrivilege	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
Token: SeIncBasePriorityPrivilege	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
Token: SeIncBasePriorityPrivilege	1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3708	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	93
PID 4000 wrote to memory of 3708	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	93
PID 4000 wrote to memory of 3708	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	93
PID 4000 wrote to memory of 4036	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	94
PID 4000 wrote to memory of 4036	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	94
PID 4000 wrote to memory of 4036	4000	8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe	94
PID 3708 wrote to memory of 3700	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	103
PID 3708 wrote to memory of 3700	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	103
PID 3708 wrote to memory of 3700	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	103
PID 3708 wrote to memory of 3416	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	104
PID 3708 wrote to memory of 3416	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	104
PID 3708 wrote to memory of 3416	3708	{01351A7A-47AE-400d-8F03-9B94565525C7}.exe	104
PID 3700 wrote to memory of 3328	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	106
PID 3700 wrote to memory of 3328	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	106
PID 3700 wrote to memory of 3328	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	106
PID 3700 wrote to memory of 1676	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	107
PID 3700 wrote to memory of 1676	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	107
PID 3700 wrote to memory of 1676	3700	{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe	107
PID 3328 wrote to memory of 4908	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	109
PID 3328 wrote to memory of 4908	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	109
PID 3328 wrote to memory of 4908	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	109
PID 3328 wrote to memory of 4584	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	110
PID 3328 wrote to memory of 4584	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	110
PID 3328 wrote to memory of 4584	3328	{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe	110
PID 4908 wrote to memory of 1516	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	111
PID 4908 wrote to memory of 1516	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	111
PID 4908 wrote to memory of 1516	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	111
PID 4908 wrote to memory of 2216	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	112
PID 4908 wrote to memory of 2216	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	112
PID 4908 wrote to memory of 2216	4908	{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe	112
PID 1516 wrote to memory of 4044	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	113
PID 1516 wrote to memory of 4044	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	113
PID 1516 wrote to memory of 4044	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	113
PID 1516 wrote to memory of 4756	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	114
PID 1516 wrote to memory of 4756	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	114
PID 1516 wrote to memory of 4756	1516	{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe	114
PID 4044 wrote to memory of 1452	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	115
PID 4044 wrote to memory of 1452	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	115
PID 4044 wrote to memory of 1452	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	115
PID 4044 wrote to memory of 4404	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	116
PID 4044 wrote to memory of 4404	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	116
PID 4044 wrote to memory of 4404	4044	{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe	116
PID 1452 wrote to memory of 2252	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	117
PID 1452 wrote to memory of 2252	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	117
PID 1452 wrote to memory of 2252	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	117
PID 1452 wrote to memory of 2412	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	118
PID 1452 wrote to memory of 2412	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	118
PID 1452 wrote to memory of 2412	1452	{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe	118
PID 2252 wrote to memory of 2236	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	119
PID 2252 wrote to memory of 2236	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	119
PID 2252 wrote to memory of 2236	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	119
PID 2252 wrote to memory of 4428	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	120
PID 2252 wrote to memory of 4428	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	120
PID 2252 wrote to memory of 4428	2252	{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe	120
PID 2236 wrote to memory of 1800	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	121
PID 2236 wrote to memory of 1800	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	121
PID 2236 wrote to memory of 1800	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	121
PID 2236 wrote to memory of 1340	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	122
PID 2236 wrote to memory of 1340	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	122
PID 2236 wrote to memory of 1340	2236	{91DE92E2-71EE-421c-828D-BBD274054F48}.exe	122
PID 1800 wrote to memory of 772	1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe	123
PID 1800 wrote to memory of 772	1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe	123
PID 1800 wrote to memory of 772	1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe	123
PID 1800 wrote to memory of 464	1800	{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe	124

C:\Users\Admin\AppData\Local\Temp\8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe
"C:\Users\Admin\AppData\Local\Temp\8c7560f39a16ef0b13199ffaaaf781c5fbe47d2738a42d88360252d748e64279.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
  C:\Windows\{01351A7A-47AE-400d-8F03-9B94565525C7}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
    C:\Windows\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
      C:\Windows\{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Windows\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
        
        C:\Windows\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Windows\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
        
        C:\Windows\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
        
        C:\Windows\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
        
        C:\Windows\{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
        
        C:\Windows\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
        
        C:\Windows\{91DE92E2-71EE-421c-828D-BBD274054F48}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
        
        C:\Windows\{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe
        
        C:\Windows\{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe
        12⤵
        Executes dropped EXE
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{607D9~1.EXE > nul
        12⤵
        
        PID:464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{91DE9~1.EXE > nul
        11⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4678~1.EXE > nul
        10⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5465~1.EXE > nul
        9⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C10B5~1.EXE > nul
        8⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB7D1~1.EXE > nul
        7⤵
        
        PID:4756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5AF4F~1.EXE > nul
        6⤵
        
        PID:2216
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B675A~1.EXE > nul
        5⤵
        
        PID:4584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D05D5~1.EXE > nul
      4⤵
      PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{01351~1.EXE > nul
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8C7560~1.EXE > nul
  2⤵
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3680 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{01351A7A-47AE-400d-8F03-9B94565525C7}.exe

Filesize
89KB

MD5
9366a1d05caa6571d6715401f71966f8

SHA1
18a3612b67395c054a947b70e33231639caa8a62

SHA256
fbc3ecbb83db111ff5004b85d9fee1884e9d33383550d2b81008e8f238392335

SHA512
5008ffe8a98797a019ae238872bcb9f8d404c4dd8027e243ecd4c9e4b15751f1b1e05deebd2371dccdc138f6acb4a3bc9fd420a054571adaddfd8da149dc3d00

Download Submit
C:\Windows\{5AF4F585-A18A-475a-B1B0-DCD46BF0B25C}.exe

Filesize
89KB

MD5
f8e0efc140731a199d5bdcd9436ffe34

SHA1
efea0de3661eb7c6589ad49e9bdbf212bf4232b2

SHA256
90293f162d95c89ac77c7c729eb2b298bc75b33500495a39421dcd045161196e

SHA512
fbd05506761b30a060d436af6a89aca0c2c1fd09ababac80aa8545af7a50f12d6418caba0eaebd6b0aad680654db5f105a0fcf3637e9bf3534fb5175fa116fb5

Download Submit
C:\Windows\{607D90CA-401C-47a4-80D4-F17C838DBE2D}.exe

Filesize
89KB

MD5
7ae70e0664812c973737041fcc81e823

SHA1
a51ad949928632739773dd3812d374605b05194a

SHA256
8b778f839a8cbd481ff2c811d7c4966a6ecf326c9c20acba7add1820e8dfe4e5

SHA512
0bf4108896e623e63a1ab9a4aa2db6b842cf12128089e89f7546a4b962952415d7d5061e7786a6306ba4232e18d639eba6d7c78ce49f47928f120b60e186ace6

Download Submit
C:\Windows\{61919B0C-E98D-4dfc-87ED-59075BFEE555}.exe

Filesize
89KB

MD5
7b3c8a4880d45ba36f7002566d6fa44e

SHA1
b57e720d153fa7c7d897d534535ba7b995b41f76

SHA256
a436e0e008b03c32e192caaa55219d66a0e776834599f98ec4def21d71a1726e

SHA512
2884792bceefe9191b02caf48666ddde40a9cc6520a78d554cc8c077bc85b536bf019a3a44b71fa23da4328160b9e5ac838ef64bc69e16d1ed6656b8a696ac08

Download Submit
C:\Windows\{91DE92E2-71EE-421c-828D-BBD274054F48}.exe

Filesize
89KB

MD5
17d58c688453fa0012911a76c4e9e05c

SHA1
1503b17355be16c8b8b973bed424206257fa208f

SHA256
afe6ead588ecdf51db9915224e1a3f60a5f60188f78fe50adda867df21534031

SHA512
6589decdce57ba0f9fe487e1adf2ddc02e9c3fe89d32b8f5935eb9cf6e0c32c01e273e4b4b9cde34a4bf1410da7997f18b676ce780fc650c3213c63fe472ce1c

Download Submit
C:\Windows\{A5465B85-3030-458d-AC02-4975FC9A33AE}.exe

Filesize
89KB

MD5
3f82b74c4eb28509ea955c94041a63bc

SHA1
40027335db5398ecfab8722fe63538f67b5f4b79

SHA256
e875a4994abdee186bc9da4685691064ae1b9ea17886430117d892ae2fb4aaa4

SHA512
8d1b399b5d6b796f31d7f4098deb01082344c9753ada819d40519cf449bf84be8e34ca5e29f79f5581f00032bf6811d356662570399fadb5f6a4c93178df10a7

Download Submit
C:\Windows\{B675AFA0-6D2B-41d7-A006-053518885CD5}.exe

Filesize
89KB

MD5
765c69064f124936e67dfe3bd4a1dba4

SHA1
2a00143ffa3a25d9df147bc72b90d22d2fc99ea9

SHA256
91bfa90e95412f625b9d29cf0c25ac2ae5c1769b10efea62bd6c256eb954fb65

SHA512
2d00345b29b9dc48e1804a55c387b132d869dbc23a6bdeee3ad81972d61e0e6e5ad42ba92110ac00178592f3a68f62c850ca18f7f9a16fde8a1757df8f1e54fd

Download Submit
C:\Windows\{C10B5A5F-6C33-4016-97F5-287B1C2C6FB9}.exe

Filesize
89KB

MD5
94de4f9a042fe690c54c655f29b05f94

SHA1
b5756d432f4b4e77649baaa09a668dd24ac3c067

SHA256
88440ca04c2bc054f0247d37dd3ca2957f53130345a31bb86a704b45c8effe5d

SHA512
935e1c67e86d5bec43819f52016148a66790b7e7be3e64afff8e9f3c5ffea4183e30e7992fefde6217d51f319f7eda13e1431c326fbb88e2ad10f76a5de9370b

Download Submit
C:\Windows\{D05D5E65-7AB8-4131-857D-1903BFF0CD96}.exe

Filesize
89KB

MD5
0c818bba710650818d599c105d1fca9a

SHA1
8708e1719abf618e06c07a10f2f1399e4258d097

SHA256
3e886ed9f6bb7995ca25580e919f79d57c8dbb75043e1cc222e6db5ade75c488

SHA512
764607e15c2c4d3d066cad3242aa163f5a9c29f956280b31bdc6079c7ace501e993b46a4975fafd7b9a32e036efeaefa483262562c79c7c4b400fd2874e84b54

Download Submit
C:\Windows\{D4678B92-B8BF-42fc-90FC-F129B8DF62C4}.exe

Filesize
89KB

MD5
5abe20e92c3a275709fe112e997ee7ab

SHA1
266058da7beea1e626a9bb73052b74dce563b95f

SHA256
8011ddda6a715ef4ef12360bf971096ec273f173df27ccc97bc035db6cf70ede

SHA512
03890a4c856be8e92ea906a542693d20f2e3a2f990d315a922df5a61801fbcf96032d1969fb5b12a59ec549e278ec0babf40ec5f2ca83cb65560c45ed38b6c25

Download Submit
C:\Windows\{FB7D10D2-43EA-4e99-BAA4-297F6B4B5843}.exe

Filesize
89KB

MD5
61d5c8ddd70b8c86e6b4f60c321cec05

SHA1
287096b5deae2354d7a3bab94725ea6e9bf1abb8

SHA256
16f5fe99c4890aa0f2bd68a6f9ab44497e1c8b4f60b7bb96abc07d6cbf931a5f

SHA512
1b1dfbaca3a9df1579a4fc3c6b7e199477fbae52d9fc50dece84d9d6ffbb687af8b492294984f38496248845704cdb2aaaa8cc28311f136ddd91d6722fa19f51

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads