d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Size

89KB
MD5

aebec3905f0fa3bc8afb2f87f9b15343
SHA1

1533300e1dae46ad7881492ee0f6074dc4abf53e
SHA256

d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be
SHA512

de4e384ece0973d0b77f44d5abd48aee04208716e0497529ba38c397c439b38642616f919857242088c7a672728ddf1525deb658bcf5a9db10df11745f01aba2
SSDEEP

768:Qvw9816vhKQLro2L4/wQRNrfrunMxVFA3b7gl5:YEGh0o2Ll2unMxVS3HgX

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}\stubpath = "C:\\Windows\\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe"	{3DCCD137-670F-4150-8917-074012D1B50B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}\stubpath = "C:\\Windows\\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe"	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCC766BB-E33C-4577-AC8A-477A854E6671}	{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DCCD137-670F-4150-8917-074012D1B50B}	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DCCD137-670F-4150-8917-074012D1B50B}\stubpath = "C:\\Windows\\{3DCCD137-670F-4150-8917-074012D1B50B}.exe"	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}\stubpath = "C:\\Windows\\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe"	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}\stubpath = "C:\\Windows\\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe"	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}	{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCC766BB-E33C-4577-AC8A-477A854E6671}\stubpath = "C:\\Windows\\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe"	{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A009F78-435B-465a-B107-5419A7A158D9}\stubpath = "C:\\Windows\\{6A009F78-435B-465a-B107-5419A7A158D9}.exe"	{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}\stubpath = "C:\\Windows\\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe"	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}	{3DCCD137-670F-4150-8917-074012D1B50B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}\stubpath = "C:\\Windows\\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe"	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F86C155B-4023-415c-8958-9A14DBAB21A0}\stubpath = "C:\\Windows\\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe"	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}\stubpath = "C:\\Windows\\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe"	{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F86C155B-4023-415c-8958-9A14DBAB21A0}	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A009F78-435B-465a-B107-5419A7A158D9}	{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe

Deletes itself 1 IoCs

pid	Process
1620	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe
2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
1760	{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
2116	{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
2916	{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
1296	{6A009F78-435B-465a-B107-5419A7A158D9}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
File created	C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe	{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
File created	C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
File created	C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	{3DCCD137-670F-4150-8917-074012D1B50B}.exe
File created	C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
File created	C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
File created	C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
File created	C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
File created	C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe	{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
File created	C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe	{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
File created	C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Token: SeIncBasePriorityPrivilege	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
Token: SeIncBasePriorityPrivilege	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe
Token: SeIncBasePriorityPrivilege	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
Token: SeIncBasePriorityPrivilege	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
Token: SeIncBasePriorityPrivilege	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
Token: SeIncBasePriorityPrivilege	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
Token: SeIncBasePriorityPrivilege	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
Token: SeIncBasePriorityPrivilege	1760	{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
Token: SeIncBasePriorityPrivilege	2116	{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
Token: SeIncBasePriorityPrivilege	2916	{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1380	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	28
PID 1276 wrote to memory of 1380	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	28
PID 1276 wrote to memory of 1380	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	28
PID 1276 wrote to memory of 1380	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	28
PID 1276 wrote to memory of 1620	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	29
PID 1276 wrote to memory of 1620	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	29
PID 1276 wrote to memory of 1620	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	29
PID 1276 wrote to memory of 1620	1276	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	29
PID 1380 wrote to memory of 2664	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	30
PID 1380 wrote to memory of 2664	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	30
PID 1380 wrote to memory of 2664	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	30
PID 1380 wrote to memory of 2664	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	30
PID 1380 wrote to memory of 2060	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	31
PID 1380 wrote to memory of 2060	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	31
PID 1380 wrote to memory of 2060	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	31
PID 1380 wrote to memory of 2060	1380	{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe	31
PID 2664 wrote to memory of 2540	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	32
PID 2664 wrote to memory of 2540	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	32
PID 2664 wrote to memory of 2540	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	32
PID 2664 wrote to memory of 2540	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	32
PID 2664 wrote to memory of 2432	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	33
PID 2664 wrote to memory of 2432	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	33
PID 2664 wrote to memory of 2432	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	33
PID 2664 wrote to memory of 2432	2664	{3DCCD137-670F-4150-8917-074012D1B50B}.exe	33
PID 2540 wrote to memory of 2684	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	36
PID 2540 wrote to memory of 2684	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	36
PID 2540 wrote to memory of 2684	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	36
PID 2540 wrote to memory of 2684	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	36
PID 2540 wrote to memory of 1900	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	37
PID 2540 wrote to memory of 1900	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	37
PID 2540 wrote to memory of 1900	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	37
PID 2540 wrote to memory of 1900	2540	{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe	37
PID 2684 wrote to memory of 2836	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	38
PID 2684 wrote to memory of 2836	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	38
PID 2684 wrote to memory of 2836	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	38
PID 2684 wrote to memory of 2836	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	38
PID 2684 wrote to memory of 2600	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	39
PID 2684 wrote to memory of 2600	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	39
PID 2684 wrote to memory of 2600	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	39
PID 2684 wrote to memory of 2600	2684	{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe	39
PID 2836 wrote to memory of 2212	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	40
PID 2836 wrote to memory of 2212	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	40
PID 2836 wrote to memory of 2212	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	40
PID 2836 wrote to memory of 2212	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	40
PID 2836 wrote to memory of 1996	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	41
PID 2836 wrote to memory of 1996	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	41
PID 2836 wrote to memory of 1996	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	41
PID 2836 wrote to memory of 1996	2836	{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe	41
PID 2212 wrote to memory of 2024	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	42
PID 2212 wrote to memory of 2024	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	42
PID 2212 wrote to memory of 2024	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	42
PID 2212 wrote to memory of 2024	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	42
PID 2212 wrote to memory of 2164	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	43
PID 2212 wrote to memory of 2164	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	43
PID 2212 wrote to memory of 2164	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	43
PID 2212 wrote to memory of 2164	2212	{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe	43
PID 2024 wrote to memory of 1760	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	44
PID 2024 wrote to memory of 1760	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	44
PID 2024 wrote to memory of 1760	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	44
PID 2024 wrote to memory of 1760	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	44
PID 2024 wrote to memory of 1148	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	45
PID 2024 wrote to memory of 1148	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	45
PID 2024 wrote to memory of 1148	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	45
PID 2024 wrote to memory of 1148	2024	{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe	45

C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
"C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
  C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe
    C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
      C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
        
        C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
      - C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
        
        C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
        
        C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
        
        C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
        
        C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
        
        C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
        
        C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe
        
        C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe
        12⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CCC76~1.EXE > nul
        12⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D99A6~1.EXE > nul
        11⤵
        
        PID:916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE3F7~1.EXE > nul
        10⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F86C1~1.EXE > nul
        9⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A9AB~1.EXE > nul
        8⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9D80E~1.EXE > nul
        7⤵
        
        PID:1996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59B3F~1.EXE > nul
        6⤵
        
        PID:2600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E305~1.EXE > nul
        5⤵
        
        PID:1900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3DCCD~1.EXE > nul
      4⤵
      PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B8F70~1.EXE > nul
    3⤵
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D9AFD0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3DCCD137-670F-4150-8917-074012D1B50B}.exe

Filesize
89KB

MD5
aac8adcf4bbf99c869007b3d233fd160

SHA1
4bc09706a376f7e8bf9f7d42f233ca153698f97c

SHA256
0153c48dcfc7bd0cae5b37a3bc021f29f59656d863a350a73dc3a98a061718e4

SHA512
74d429e1075e87f219b844bab6856b1a383bbbaf26d59d727eea39b182f4c6c0703909e44814603abad7c47bfcf61b8ddacd976f3cb99c2a734f961066ed832c

Download Submit
C:\Windows\{4E305D7C-56CC-48a5-A64D-DEC8E0F192C8}.exe

Filesize
89KB

MD5
1cf4e2c41260a369c213f410597374e2

SHA1
d0d9fb12b6e61280fb86dd3a27abd8422f60982f

SHA256
24db87829fd7fa241a660e140d057a262531974cf6c8c3061d471cf10d1844b3

SHA512
45d8faf9a45751eb2f730d078f5040145d1697ac916c201e0c364fa6737fe7e5d1159ebe11655da56413488a65f3f37b9c7e01429c2d596f2c6ba83d011b3d5b

Download Submit
C:\Windows\{59B3F407-92FA-4a73-A7A5-8C3CF4C9B1B7}.exe

Filesize
89KB

MD5
7497c4f84e05ca7b7e7c20ee089a830b

SHA1
a4574c97e6dde57b4b08c87b07ba63f34a88d320

SHA256
4ec7698d8bd04b9c487633846f93db91e98e128b0db585338adc33fb1aa77208

SHA512
08c5046e7463ce93f0f6f7ae69f220c87648ec1029e003df942aa1fc51ba3f6c1fc88c2bb5ca5e67335f89fdeac04feaefd905f57631b454244b9bfb43820794

Download Submit
C:\Windows\{6A009F78-435B-465a-B107-5419A7A158D9}.exe

Filesize
89KB

MD5
4c50f4bbf5de7a9286819ade69866474

SHA1
48eb1398883dd69de76349880f97651c3e9dcffa

SHA256
443fc166803444dce31122c7e6c6ebcafb3e66c55e4569a4ae701875259f2e9b

SHA512
dbaa7b9f5a500c76ce444115d984dbe9a7d3cd1be7a2708a89ee7c51efa445b0a6bf6631d68f3aae32ac66dc7aa20c5171cb4a2f238d9fc17f6efdc538195489

Download Submit
C:\Windows\{6A9AB62A-0E8F-470c-9F4B-86B2293EF835}.exe

Filesize
89KB

MD5
b0376d673cc2f0caddb922272f5aadce

SHA1
8734b5ffdffc950bcc589e0f4eca650b30d3de4a

SHA256
b1b4b1d969e253827a9be45d7d93b04acb4b7fd613eb09e98cd2f1a17028295b

SHA512
acb43103bdf848a0d7b799c018b157aa6584bdc107a514f25cea73a489ab5f55dd83a26a703afafa8e2351aca0b4b88225e1a64ef50c78b566b018b2d3cdaefc

Download Submit
C:\Windows\{9D80EB96-A3EB-4275-AA3C-B45DC79D0051}.exe

Filesize
89KB

MD5
6d4153b73e69a5c196fa2b05bc00112c

SHA1
420f2b4eb90330b41fe2b2549d56ddb4c8849e90

SHA256
b2290b6e36015a1242adc9965b9a2e23176c8b5e35f9cbfdab49abe80020cac5

SHA512
66b7a12c3f0eca5c1fa2a77c50aa7e695b212947ab27cfbda111f98ff66ad57d8990b4aaca67ea9483c2e3af52bd3f3e23d18616230f2c4341038b182896c634

Download Submit
C:\Windows\{B8F70270-6EF8-4dfc-8517-79DAFB96AC66}.exe

Filesize
89KB

MD5
8bac482e58f8f376e9e04cc661a4369e

SHA1
fac3a29fb63c0f9303093b48b5dbf88689ab17e0

SHA256
d5c2abdab626d88358301dadff00cb285289c7f5cf0f4e0a9f71f5e0c4f1e63a

SHA512
16b0f40d1ca2f9101db44cbc35ace8cfdbdec42550c828dfb299a94b816f3a551d399caf271732e4748f4bd9a4e8ce029d6f15b66a427eb1fc74d1cdcea84eb6

Download Submit
C:\Windows\{CCC766BB-E33C-4577-AC8A-477A854E6671}.exe

Filesize
89KB

MD5
dfc8192e5e5794a0aa50c827f0328967

SHA1
9707679d63930d3e5e7684a7d720667de2fc311b

SHA256
13d42503827ab11c01ea1a8e84a671a9c7310929826b7c24de12dcc3f3557121

SHA512
e5aa0807684af50bdfe3dcd76c162d30de46292989d0a43ec362db6f13de48b5903b7e4690d901429e274881c241e3bfb1702cf8c4eef12e3dcea8ebbb11930e

Download Submit
C:\Windows\{D99A6E4D-A602-4d0e-8792-2FC66837D77A}.exe

Filesize
89KB

MD5
2c4ea9868d028d72fe267a818b5cc0a7

SHA1
2a317c26028c447376ed778d9b98a2d8ada4df19

SHA256
8b5f20f1187af750b6ed4a2157a117242c15c6fc153ce1040359cc1d363ec25f

SHA512
f2c939433c583e57cf1de24a7683e2a5dbe01f55ebdde5cd9bebdf98d5044c4d65f494d22d33b1f69d24728f1811289a766865a545c9a3d5934adce8577f5811

Download Submit
C:\Windows\{EE3F7027-7318-434a-A6E6-EFB2481AAC89}.exe

Filesize
89KB

MD5
9277e66519ce2da03f0379e90f5f1636

SHA1
ff7c5c26accf2106fa10aa88e6bd4923ddf68b4f

SHA256
61d60b7b3ac8633a7380353f620d35623934a00de2182ffa2b4227ac3ba492b5

SHA512
713dd0d329c839672a242de69744e518685db442a4a836f5474732e0bcfc2ef82aca66c32a9803cccf3ecbe6c4e8818470ff9b867e2c62926cfdf59c72b10537

Download Submit
C:\Windows\{F86C155B-4023-415c-8958-9A14DBAB21A0}.exe

Filesize
89KB

MD5
41fe903e436827353a520e00606f4552

SHA1
022d74524c23b24cb2313835797d06e23455fc4b

SHA256
d7bd5179a76ca19d1424f2c3f64df3e1c45431560b2d235eecbd81129e988450

SHA512
3d8b34f7859e9073e97d06feccf20912743203d965abde4b813ca5965202b838e2d331a1c2b98335c5a29df8c473264af105fd9a5b76d557790271e7a216727c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads