58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Size

90KB
MD5

4511d44ebb6011fcd1159a1a297b4f39
SHA1

85375dc2a261eaa559f21a7a8be48f29d166328c
SHA256

58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b
SHA512

a71ae08abd9db210126059abf558fe6c7a143496d510be1abf9db92a12d6ea8aa7d3166dba14db9ef3ea5c87181275901ecc7611dba2ac4f03ff619fee69c6c1
SSDEEP

768:Qvw9816vhKQLroR4/wQRNrfrunMxVFA3b7glw6:YEGh0oRl2unMxVS3Hgl

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF844EE7-70C8-42be-8546-018D5904AA7C}\stubpath = "C:\\Windows\\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe"	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2533F393-E2E3-43b2-9079-C3A6416935F4}	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95E6A248-7D9F-4587-80EA-E4B4309D3345}	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95E6A248-7D9F-4587-80EA-E4B4309D3345}\stubpath = "C:\\Windows\\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe"	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}\stubpath = "C:\\Windows\\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe"	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}	{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}	{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{975DD46B-63BB-4235-9920-11A61344DAA4}	{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}\stubpath = "C:\\Windows\\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe"	{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}\stubpath = "C:\\Windows\\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe"	{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF844EE7-70C8-42be-8546-018D5904AA7C}	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2533F393-E2E3-43b2-9079-C3A6416935F4}\stubpath = "C:\\Windows\\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe"	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA920A8-BB67-4e44-8187-E7C1336A8403}	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BA920A8-BB67-4e44-8187-E7C1336A8403}\stubpath = "C:\\Windows\\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe"	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE17A831-9232-466f-A45F-B151A3E1F7C2}	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE17A831-9232-466f-A45F-B151A3E1F7C2}\stubpath = "C:\\Windows\\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe"	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}\stubpath = "C:\\Windows\\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe"	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{975DD46B-63BB-4235-9920-11A61344DAA4}\stubpath = "C:\\Windows\\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe"	{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}\stubpath = "C:\\Windows\\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe"	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe

Deletes itself 1 IoCs

pid	Process
2060	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
1648	{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
2968	{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
2884	{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe
796	{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
File created	C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
File created	C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
File created	C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
File created	C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
File created	C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe	{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
File created	C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
File created	C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
File created	C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
File created	C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe	{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
File created	C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe	{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
Token: SeIncBasePriorityPrivilege	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
Token: SeIncBasePriorityPrivilege	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
Token: SeIncBasePriorityPrivilege	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
Token: SeIncBasePriorityPrivilege	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
Token: SeIncBasePriorityPrivilege	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
Token: SeIncBasePriorityPrivilege	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
Token: SeIncBasePriorityPrivilege	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
Token: SeIncBasePriorityPrivilege	1648	{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
Token: SeIncBasePriorityPrivilege	2968	{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
Token: SeIncBasePriorityPrivilege	2884	{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2588	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	29
PID 2108 wrote to memory of 2588	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	29
PID 2108 wrote to memory of 2588	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	29
PID 2108 wrote to memory of 2588	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	29
PID 2108 wrote to memory of 2060	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	30
PID 2108 wrote to memory of 2060	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	30
PID 2108 wrote to memory of 2060	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	30
PID 2108 wrote to memory of 2060	2108	58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe	30
PID 2588 wrote to memory of 2364	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	31
PID 2588 wrote to memory of 2364	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	31
PID 2588 wrote to memory of 2364	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	31
PID 2588 wrote to memory of 2364	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	31
PID 2588 wrote to memory of 3024	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	32
PID 2588 wrote to memory of 3024	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	32
PID 2588 wrote to memory of 3024	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	32
PID 2588 wrote to memory of 3024	2588	{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe	32
PID 2364 wrote to memory of 2360	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	33
PID 2364 wrote to memory of 2360	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	33
PID 2364 wrote to memory of 2360	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	33
PID 2364 wrote to memory of 2360	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	33
PID 2364 wrote to memory of 2692	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	34
PID 2364 wrote to memory of 2692	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	34
PID 2364 wrote to memory of 2692	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	34
PID 2364 wrote to memory of 2692	2364	{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe	34
PID 2360 wrote to memory of 3004	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	37
PID 2360 wrote to memory of 3004	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	37
PID 2360 wrote to memory of 3004	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	37
PID 2360 wrote to memory of 3004	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	37
PID 2360 wrote to memory of 2972	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	38
PID 2360 wrote to memory of 2972	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	38
PID 2360 wrote to memory of 2972	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	38
PID 2360 wrote to memory of 2972	2360	{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe	38
PID 3004 wrote to memory of 1928	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	39
PID 3004 wrote to memory of 1928	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	39
PID 3004 wrote to memory of 1928	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	39
PID 3004 wrote to memory of 1928	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	39
PID 3004 wrote to memory of 1236	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	40
PID 3004 wrote to memory of 1236	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	40
PID 3004 wrote to memory of 1236	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	40
PID 3004 wrote to memory of 1236	3004	{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe	40
PID 1928 wrote to memory of 1600	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	41
PID 1928 wrote to memory of 1600	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	41
PID 1928 wrote to memory of 1600	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	41
PID 1928 wrote to memory of 1600	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	41
PID 1928 wrote to memory of 1968	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	42
PID 1928 wrote to memory of 1968	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	42
PID 1928 wrote to memory of 1968	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	42
PID 1928 wrote to memory of 1968	1928	{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe	42
PID 1600 wrote to memory of 1644	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	43
PID 1600 wrote to memory of 1644	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	43
PID 1600 wrote to memory of 1644	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	43
PID 1600 wrote to memory of 1644	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	43
PID 1600 wrote to memory of 2404	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	44
PID 1600 wrote to memory of 2404	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	44
PID 1600 wrote to memory of 2404	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	44
PID 1600 wrote to memory of 2404	1600	{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe	44
PID 1644 wrote to memory of 1648	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	45
PID 1644 wrote to memory of 1648	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	45
PID 1644 wrote to memory of 1648	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	45
PID 1644 wrote to memory of 1648	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	45
PID 1644 wrote to memory of 2408	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	46
PID 1644 wrote to memory of 2408	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	46
PID 1644 wrote to memory of 2408	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	46
PID 1644 wrote to memory of 2408	1644	{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe	46

C:\Users\Admin\AppData\Local\Temp\58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe
"C:\Users\Admin\AppData\Local\Temp\58e7fc589a3c05771ab63c2dfa4754b931e0ef4d18a679f973943efddb59426b.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
  C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
    C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
      C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
        
        C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
      - C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
        
        C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
        
        C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
        
        C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
        
        C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
        
        C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe
        
        C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe
        
        C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe
        12⤵
        Executes dropped EXE
        
        PID:796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6724~1.EXE > nul
        12⤵
        
        PID:692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{975DD~1.EXE > nul
        11⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12F09~1.EXE > nul
        10⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0B0D~1.EXE > nul
        9⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE17A~1.EXE > nul
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8667B~1.EXE > nul
        7⤵
        
        PID:1968
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95E6A~1.EXE > nul
        6⤵
        
        PID:1236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0BA92~1.EXE > nul
        5⤵
        
        PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2533F~1.EXE > nul
      4⤵
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AF844~1.EXE > nul
    3⤵
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\58E7FC~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0BA920A8-BB67-4e44-8187-E7C1336A8403}.exe

Filesize
90KB

MD5
0d55d818fbb51d3886455bd4fd46f062

SHA1
6c2483ad1d0d7fe144dc0755c25d641e3f2bd741

SHA256
92c0fc2bfb684cddb59eb8f70eb82daf314f8b9dc4e039a77c386ef6bf1bf1a9

SHA512
8de543fcfd0b5d17b3bc5c407f4e79fe43c667eb3d7449b6577fd82e4075f0d31586f809efff23435b2bdcd5f0db4546786249d78142fc67541287dec245c469

Download Submit
C:\Windows\{12F0914C-084F-4ef4-BB1D-3090EB1F5082}.exe

Filesize
90KB

MD5
a85bba324c48cc0ce8ba646bbf6c77aa

SHA1
6e09c7622dd017d13f11f5a5616a184d634cdefb

SHA256
97be366f2c71c386ae74711e21bf95ac712d8b1065da20891dc59e3e5c137d6c

SHA512
64566c8e20075f887689cc49495ea2590856766cbe0d2a65d3feb961ca36c95302cd8a8676a779eaa8f9dda09c63e00cae12b0c5d59c6fd4fb913cfc6df590d6

Download Submit
C:\Windows\{2533F393-E2E3-43b2-9079-C3A6416935F4}.exe

Filesize
90KB

MD5
383a1b5df46bb00ffa5fa34c5a397715

SHA1
21b888af3bb85c6982f5e4a8c4902892438800a8

SHA256
c4283842a64c2caa9fd40d3bd0ff3bbd3e8c5a36128f55be797933090fbd3ba4

SHA512
c747b6c0670660e15b8cc6afda0e0e9c59c03f097d456234de4fe79990ad75aa4229a32a335f2802deb113a4e261d52f4813e705af9256ab217bc0d870f2c91e

Download Submit
C:\Windows\{8667B6DA-CC3C-4cdb-893E-BFEB0B1501B4}.exe

Filesize
90KB

MD5
03e2fda90f8d8ac0a40dd4a42959c1ab

SHA1
48e5c8919e0204ab7c4d13603b0e719709989824

SHA256
a18919a0bdbf24f5592071774e0b9b04bdf5a4e6c86a898221e665119935b78b

SHA512
4809322b57abf59e69e9fc942955e0c66ca3fc540da3aa1f17034a2d13b1047393e33efef4ebcec6373c7aecabc5ada26195768218a27591671364b0971fe7d9

Download Submit
C:\Windows\{95E6A248-7D9F-4587-80EA-E4B4309D3345}.exe

Filesize
90KB

MD5
d529414e9f41a4760597ba121941277b

SHA1
fcf7808b46cef4fdcceaba4ec8ce042705a7868a

SHA256
cea4bd6afcef209c9494fc4850ed5b053a89c429e3883b18e0a62fd9a4afe2d0

SHA512
21b0c8b4b260a242d5866549e38ff942cfc458ca711525abba03a22d8a2e6af385dd4fb6851459fc80763d2dfb1c4238562fa77e35d071f4b6067e010b1decb9

Download Submit
C:\Windows\{975DD46B-63BB-4235-9920-11A61344DAA4}.exe

Filesize
90KB

MD5
a6a8ab220d52e63fb9b74a5be897854a

SHA1
b5235272e277fccb295a1f37246d8251ce03c4a8

SHA256
ac92541e552c96732e71a06b128736314e73c237032726b5a0b14ca30aae25f3

SHA512
99e4dcc40bcc2a752ff9bc8a605d556e6b6bb823d087bdef7c8047f52d539db4ca8ef5d8bf027f039f2a8058192f92d029a24e761bfe2ef6d44c822634996ffe

Download Submit
C:\Windows\{AE17A831-9232-466f-A45F-B151A3E1F7C2}.exe

Filesize
90KB

MD5
02bd3d55cae3986d5fefbed5217a1f39

SHA1
0d70fad2f64f1073591c431f3ce50ac1dd351692

SHA256
6de38037c500fbc162547f6aaf5841c8d218ac7460a7de58d7d21f30a19d3d28

SHA512
70fbd13269c34402bc3ac2317be1389bc080a63182d376b36929436b9979e994d90c7f86979e9e2e8778f99410fbcd77368c9aa10c6e1e69eaf1d6d085da1660

Download Submit
C:\Windows\{AF844EE7-70C8-42be-8546-018D5904AA7C}.exe

Filesize
90KB

MD5
85a6b1ac8fd047718f615457591b7203

SHA1
69477a7033bd120c521c92ea19e8add84f193642

SHA256
8f20d7eeee886642c3ebda2461e0673d80b1d31a49795907b1344d2e2072a345

SHA512
529b0d4be5871e186570612afacdd6f95559a293de32371fb3e9a6a329f80a1df900de5a94975b5bd5fdf9154ba0a8e14a487c9f583a9ad4f2e6e39c15d38c94

Download Submit
C:\Windows\{D0B0D8D2-70F9-4e30-8A46-92EB54BD5127}.exe

Filesize
90KB

MD5
fc6999edfe3796d723a4dfb9db319419

SHA1
dd17eb8bd05a82f14d839fbac5543aea9284284d

SHA256
afbf0b54baf0c3793a5afc174033a01dce96b009718b3e00d5de709fb9fe4ff8

SHA512
50faaaf1b0193118af5a565cf817fd6254465bc905456c530e1edf412ac70ef0888f1f216b455a55a372c5a373e0673d2e7978e2317e2ace1161950db2545700

Download Submit
C:\Windows\{D6724EEB-A70E-499f-94E8-4EDD16FA94E3}.exe

Filesize
90KB

MD5
ae79b74885d069e917c65934964180bf

SHA1
27cad69ed5e85ef258c74c9b49685969942d39f7

SHA256
f994bd7a0f94dca15bdc3197166cc5ca5b063ca72fc88e199dbc78abd262d9b7

SHA512
367614c61fe6c10650e3dc6db92bd4e3d5bc0bdfb2017c4b98e85d8947df9a022a10117740761457d43af047a7ee8b27a8aa46d9c907e18ca83eab7149007c0c

Download Submit
C:\Windows\{E08DC862-A6D1-4229-B0D4-0C80B5B01EF4}.exe

Filesize
90KB

MD5
6f6ad8ca305ed6bbce6dcd496e259f0c

SHA1
cf3faf979f3ba0cc042d9dfa610282d3d6e44990

SHA256
ea8a9cfb0025a06b2c66485b33dabc016fb8a65c7507a141863f24b15f0a1f39

SHA512
54f46f71de9078e6436bee6a3348ab093b6450b0e5567c3ae9a0a2fd15e004be5c541f1c5111e52cdfce2340c40761eb7b5dec2e5e57b362adf43b759532e2fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads