d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be

Analysis

max time kernel
149s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Size

89KB
MD5

aebec3905f0fa3bc8afb2f87f9b15343
SHA1

1533300e1dae46ad7881492ee0f6074dc4abf53e
SHA256

d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be
SHA512

de4e384ece0973d0b77f44d5abd48aee04208716e0497529ba38c397c439b38642616f919857242088c7a672728ddf1525deb658bcf5a9db10df11745f01aba2
SSDEEP

768:Qvw9816vhKQLro2L4/wQRNrfrunMxVFA3b7gl5:YEGh0o2Ll2unMxVS3HgX

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBB94B55-A450-491d-852C-56A245F2D9A7}	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{530C48AB-4644-4a29-AA2C-65A592678471}\stubpath = "C:\\Windows\\{530C48AB-4644-4a29-AA2C-65A592678471}.exe"	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3519E27D-BB08-4753-903A-60132D4E5352}	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}	{625E534A-E085-4789-9E00-D24031ED8E05}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D954C19E-CD83-4558-9E57-ABD27F6BE115}\stubpath = "C:\\Windows\\{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe"	{3519E27D-BB08-4753-903A-60132D4E5352}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}\stubpath = "C:\\Windows\\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe"	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBB94B55-A450-491d-852C-56A245F2D9A7}\stubpath = "C:\\Windows\\{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe"	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}	{530C48AB-4644-4a29-AA2C-65A592678471}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}\stubpath = "C:\\Windows\\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe"	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3519E27D-BB08-4753-903A-60132D4E5352}\stubpath = "C:\\Windows\\{3519E27D-BB08-4753-903A-60132D4E5352}.exe"	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D954C19E-CD83-4558-9E57-ABD27F6BE115}	{3519E27D-BB08-4753-903A-60132D4E5352}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}\stubpath = "C:\\Windows\\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}.exe"	{625E534A-E085-4789-9E00-D24031ED8E05}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{530C48AB-4644-4a29-AA2C-65A592678471}	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}\stubpath = "C:\\Windows\\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe"	{530C48AB-4644-4a29-AA2C-65A592678471}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8757FA03-2135-4b04-B060-D7D8EFAC803B}	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8757FA03-2135-4b04-B060-D7D8EFAC803B}\stubpath = "C:\\Windows\\{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe"	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}\stubpath = "C:\\Windows\\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe"	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}\stubpath = "C:\\Windows\\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe"	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{625E534A-E085-4789-9E00-D24031ED8E05}	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{625E534A-E085-4789-9E00-D24031ED8E05}\stubpath = "C:\\Windows\\{625E534A-E085-4789-9E00-D24031ED8E05}.exe"	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe

Executes dropped EXE 11 IoCs

pid	Process
2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe
5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe
4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe
1268	{625E534A-E085-4789-9E00-D24031ED8E05}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
File created	C:\Windows\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
File created	C:\Windows\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
File created	C:\Windows\{3519E27D-BB08-4753-903A-60132D4E5352}.exe	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
File created	C:\Windows\{625E534A-E085-4789-9E00-D24031ED8E05}.exe	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe
File created	C:\Windows\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}.exe	{625E534A-E085-4789-9E00-D24031ED8E05}.exe
File created	C:\Windows\{530C48AB-4644-4a29-AA2C-65A592678471}.exe	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
File created	C:\Windows\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	{530C48AB-4644-4a29-AA2C-65A592678471}.exe
File created	C:\Windows\{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
File created	C:\Windows\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
File created	C:\Windows\{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	{3519E27D-BB08-4753-903A-60132D4E5352}.exe
File created	C:\Windows\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
Token: SeIncBasePriorityPrivilege	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
Token: SeIncBasePriorityPrivilege	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe
Token: SeIncBasePriorityPrivilege	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
Token: SeIncBasePriorityPrivilege	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
Token: SeIncBasePriorityPrivilege	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
Token: SeIncBasePriorityPrivilege	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
Token: SeIncBasePriorityPrivilege	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
Token: SeIncBasePriorityPrivilege	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe
Token: SeIncBasePriorityPrivilege	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
Token: SeIncBasePriorityPrivilege	1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2172	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	82
PID 3724 wrote to memory of 2172	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	82
PID 3724 wrote to memory of 2172	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	82
PID 3724 wrote to memory of 3596	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	83
PID 3724 wrote to memory of 3596	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	83
PID 3724 wrote to memory of 3596	3724	d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe	83
PID 2172 wrote to memory of 4176	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	84
PID 2172 wrote to memory of 4176	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	84
PID 2172 wrote to memory of 4176	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	84
PID 2172 wrote to memory of 4596	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	85
PID 2172 wrote to memory of 4596	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	85
PID 2172 wrote to memory of 4596	2172	{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe	85
PID 4176 wrote to memory of 5044	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	91
PID 4176 wrote to memory of 5044	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	91
PID 4176 wrote to memory of 5044	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	91
PID 4176 wrote to memory of 2904	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	92
PID 4176 wrote to memory of 2904	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	92
PID 4176 wrote to memory of 2904	4176	{530C48AB-4644-4a29-AA2C-65A592678471}.exe	92
PID 5044 wrote to memory of 3920	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	95
PID 5044 wrote to memory of 3920	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	95
PID 5044 wrote to memory of 3920	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	95
PID 5044 wrote to memory of 4628	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	96
PID 5044 wrote to memory of 4628	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	96
PID 5044 wrote to memory of 4628	5044	{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe	96
PID 3920 wrote to memory of 3148	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	97
PID 3920 wrote to memory of 3148	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	97
PID 3920 wrote to memory of 3148	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	97
PID 3920 wrote to memory of 1596	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	98
PID 3920 wrote to memory of 1596	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	98
PID 3920 wrote to memory of 1596	3920	{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe	98
PID 3148 wrote to memory of 2212	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	99
PID 3148 wrote to memory of 2212	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	99
PID 3148 wrote to memory of 2212	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	99
PID 3148 wrote to memory of 2900	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	100
PID 3148 wrote to memory of 2900	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	100
PID 3148 wrote to memory of 2900	3148	{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe	100
PID 2212 wrote to memory of 2552	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	101
PID 2212 wrote to memory of 2552	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	101
PID 2212 wrote to memory of 2552	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	101
PID 2212 wrote to memory of 1660	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	102
PID 2212 wrote to memory of 1660	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	102
PID 2212 wrote to memory of 1660	2212	{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe	102
PID 2552 wrote to memory of 2980	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	103
PID 2552 wrote to memory of 2980	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	103
PID 2552 wrote to memory of 2980	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	103
PID 2552 wrote to memory of 4880	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	104
PID 2552 wrote to memory of 4880	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	104
PID 2552 wrote to memory of 4880	2552	{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe	104
PID 2980 wrote to memory of 4180	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	105
PID 2980 wrote to memory of 4180	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	105
PID 2980 wrote to memory of 4180	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	105
PID 2980 wrote to memory of 4556	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	106
PID 2980 wrote to memory of 4556	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	106
PID 2980 wrote to memory of 4556	2980	{3519E27D-BB08-4753-903A-60132D4E5352}.exe	106
PID 4180 wrote to memory of 1188	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	107
PID 4180 wrote to memory of 1188	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	107
PID 4180 wrote to memory of 1188	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	107
PID 4180 wrote to memory of 768	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	108
PID 4180 wrote to memory of 768	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	108
PID 4180 wrote to memory of 768	4180	{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe	108
PID 1188 wrote to memory of 1268	1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe	109
PID 1188 wrote to memory of 1268	1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe	109
PID 1188 wrote to memory of 1268	1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe	109
PID 1188 wrote to memory of 1056	1188	{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe	110

C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe
"C:\Users\Admin\AppData\Local\Temp\d9afd0df0f47107a0823a16470f3c2af490a994926ef1d63eff7041324eb77be.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
  C:\Windows\{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\{530C48AB-4644-4a29-AA2C-65A592678471}.exe
    C:\Windows\{530C48AB-4644-4a29-AA2C-65A592678471}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
      C:\Windows\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
        
        C:\Windows\{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3920
      - C:\Windows\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
        
        C:\Windows\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
        
        C:\Windows\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
        
        C:\Windows\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\{3519E27D-BB08-4753-903A-60132D4E5352}.exe
        
        C:\Windows\{3519E27D-BB08-4753-903A-60132D4E5352}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
        
        C:\Windows\{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe
        
        C:\Windows\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\{625E534A-E085-4789-9E00-D24031ED8E05}.exe
        
        C:\Windows\{625E534A-E085-4789-9E00-D24031ED8E05}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1268
        
        C:\Windows\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}.exe
        
        C:\Windows\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}.exe
        13⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{625E5~1.EXE > nul
        13⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5EBB0~1.EXE > nul
        12⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D954C~1.EXE > nul
        11⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3519E~1.EXE > nul
        10⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B5A6C~1.EXE > nul
        9⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E54D~1.EXE > nul
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B51AF~1.EXE > nul
        7⤵
        
        PID:2900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8757F~1.EXE > nul
        6⤵
        
        PID:1596
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5E0F2~1.EXE > nul
        5⤵
        
        PID:4628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{530C4~1.EXE > nul
      4⤵
      PID:2904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DBB94~1.EXE > nul
    3⤵
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D9AFD0~1.EXE > nul
  2⤵
  PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0E54D0F9-F4F0-4430-8EE8-90D42D9E9174}.exe

Filesize
89KB

MD5
2c990dbffd9d885698df138347907f66

SHA1
38e4e4926b0690c61380edb5b910719fde87fa79

SHA256
64fb0b76e3864a7a7012d6ac2aa8dcfc00a7bb788698eca19974b24df8453bb0

SHA512
f2754b5866e3f9bce3d9d6cb9a99ef5d8cf1dd8362d5b818f490019e189633208b81988d0eaf7ddeae0f986a52702406a6a89e3752d4b51d04cd9c007192278e

Download Submit
C:\Windows\{3519E27D-BB08-4753-903A-60132D4E5352}.exe

Filesize
89KB

MD5
75ad5ee29322560c2cc5b839920c180c

SHA1
afc870a0dc672e4f057b55db402a46fbc5ea8e38

SHA256
34d88a76f0ed3be10f73226409c80f1e3eac3941f839b7ecf2cc87e62aa8d236

SHA512
c568d3d6189372b237ba314659e551399d096bb49e44f707d8adeb49e135c34576023bd2fade74870ffab30684946fe0f15f59397de09b4ea42f34150d9fa654

Download Submit
C:\Windows\{4E4BE132-60AC-4ff0-9266-C404D5DF3F90}.exe

Filesize
89KB

MD5
317e1d97ffb07a102f2cd2cf6c50382e

SHA1
a95d343a3d76c024231233a22705021123c87cd0

SHA256
69bd20ee0381d6ae84591f9455e9af9db768e288b855c438fa79d8bac4a4ce88

SHA512
d5ff58765d58d1f048b142203036e53abe2fe51264b9169da9df2177fcca4e6a526b5db7b967db25a86cee1eb8afeadac9887dba54d7742eb9f19734051f77aa

Download Submit
C:\Windows\{530C48AB-4644-4a29-AA2C-65A592678471}.exe

Filesize
89KB

MD5
de40801a1aad88b425e79e2f5aedcb48

SHA1
f8b030a69ede949e77ab1ecddcdc714d79fed247

SHA256
8a7109d89065e1b1993dc54aafb15fc0b720c69a63c860605660557e68ae8bfc

SHA512
78ba86f9134db2b963040eaf67c429ab733a44db83cf3df34dfb87b6e9d6c2b7c5ed4fbcc3cfb6468f5fc0f82f6c7528d63eb9df715527f7497c0febab1b9f4c

Download Submit
C:\Windows\{5E0F2CAB-8FED-40f8-A278-286DE4570D9A}.exe

Filesize
89KB

MD5
6e15605be5a2c52349b21149503c9a74

SHA1
2dc0f8cff2719c4df1851ee4b2e83db6a51aabae

SHA256
04ba8408e44e66b2d5a1392ebaa8ae126943cba23ba24f4a038d2fd85c6ac652

SHA512
a3564ba0875b5aa9777b9c43b75deffd0a134c3d42ed94f0683f276cb6c3cf61fd0ce7f5e4e795529e05e2d994f6b2b394188ca40875695934d28261eeb419c8

Download Submit
C:\Windows\{5EBB0B4B-7457-4272-8AA4-6D7DCBBB97B1}.exe

Filesize
89KB

MD5
a285aa2e3ae9a35d106c238151379f96

SHA1
84c3b83aa420786d74edb2bee0ba8782364b0f73

SHA256
9553b7cdeacba181fba2c3de0993da3f3afec52cd8b9f0a7dc271f05cb799b50

SHA512
283511cbeba87bf9431cfa7bc463aedc405d039b3aeb081d7152e562b0367cbc6d7de24bed7c5a2e4a7e4448b0b125692caa61c3524fd7698c562ee1cd205e5d

Download Submit
C:\Windows\{625E534A-E085-4789-9E00-D24031ED8E05}.exe

Filesize
89KB

MD5
0bff623cabfce9cd716593f93fcdfc5f

SHA1
ff0011d9fb394e9ed9caf7a1fa619c75263f7354

SHA256
02cce2d38ccbcf6232a469e1f8930952292a1cff7c6f1dd1d3be0318c8bb16e5

SHA512
a9873f90313687119db16c796651e221d5c0cab5521a4e9af16e9409c38e5d84692088f28e2c971c2465de9587417ac7b2787a6ee2d31ad3cf31444ab6e0e1b9

Download Submit
C:\Windows\{8757FA03-2135-4b04-B060-D7D8EFAC803B}.exe

Filesize
89KB

MD5
28d01e1f1b52b55af8e5e893d013a7f7

SHA1
c2a55e1b0a0bc140c601a6694a94bab655580e2d

SHA256
8733d554b256411c81d4d2f060ca2c81870d4e9aed253e5f43bfc57711ee658e

SHA512
0fbfefc4413330cd08fb7dbaa4b2d0849ceb4f4ca9ac693b690514132023ac8a616459490301d2207e10fc2082a4efaa1015c0729d23e672e1326fc830be1379

Download Submit
C:\Windows\{B51AFDA2-F4D6-4be0-BA5E-98E6D7D7C951}.exe

Filesize
89KB

MD5
a54ab742c2d08a01d217be08c83c40e8

SHA1
44c18c93f19b0652ece0ec4a67dbb85e1a5175b6

SHA256
2eae3089baaf18174c711af48fdf0bfe69ed62b996840a31ae6e79fdc919bcb0

SHA512
86497348c0bdf368d84b88358f4453fb47823345be3a6b06411bb047d566518e4749490b5d992cac8d4503d0ef61cb15866ab05148729f4532daf0ae1b7e66d0

Download Submit
C:\Windows\{B5A6C0BA-038D-4e7b-8642-EF7C2AD141B5}.exe

Filesize
89KB

MD5
2ab2660268e14abe4eba06270e162464

SHA1
29aec500be2954de29212c23486d9bdf573ee681

SHA256
5a7d2c6360128a4a93d5c4b11b1fd0d8a2906ded42a81f3d18b49b4fd5a98b1f

SHA512
29f0cd5048a070b25993b8d956d6abcb6fc9540081766cbe79ec419de5f46d1fbebfbc0313087f0b05f7982d00a6039bf2301b0dbd9de4b6334acb6637f6e904

Download Submit
C:\Windows\{D954C19E-CD83-4558-9E57-ABD27F6BE115}.exe

Filesize
89KB

MD5
ad2f995211879ef0e5daf1bd2397a090

SHA1
a71805c16bb007ad21840286b4ad75e2e9eae844

SHA256
587256de9e36ea6c71118b9bf7fdf4e81c0fab4cd22ba59ccda01711a44bdadf

SHA512
0e53d465d059972aabba7a35d7b0b7b698c537912658bbfb2931f6d471148d7f330e1eb26e12fe70a69e8952128697dd40a477d85d5694abac2cd5fd5a99f0ca

Download Submit
C:\Windows\{DBB94B55-A450-491d-852C-56A245F2D9A7}.exe

Filesize
89KB

MD5
a4ccf3d49c1b1a8791c7c8f7a18b0cf8

SHA1
215fbf388153f105d11f2b5d1880deb294f2321b

SHA256
cb427aca9aa7b7b2a9d27c979fd07dcafc1d5d0e1b7734045271d188217d4949

SHA512
97dd4d36d833b3d85147cb9ad13a046754db2ba01898e3d5c18f32b75bd8f189988d941f1809519f25b660f290f8ac43d8ce4a6a75417f8981f42b8e7c16920d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads