5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
Size

79KB
MD5

0c8d320a1db1aaf29599053baff755aa
SHA1

d6aadff847e0f3b7c23c8d1cf75154c4427a30c5
SHA256

5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b
SHA512

8ea4751c8a7a6395806d5c3f9509cfb520d0af1899646b8e149e3f225912f134b189fbb694cfbb478f5278c926d9185e7c8335fb35bbf52c61de1c6945910baf
SSDEEP

768:4vw9816vhKQLroK4/wQzXOQ69zbjlAAX5e9zz:wEGh0oKlGizbR9Xwzz

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50BB4542-DF13-4db8-B163-25AA1508EDDE}\stubpath = "C:\\Windows\\{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe"	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5792C002-2234-480b-9CB9-6777361016E0}\stubpath = "C:\\Windows\\{5792C002-2234-480b-9CB9-6777361016E0}.exe"	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40680F4C-E230-42c5-B606-588EB31BF2F6}	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE04062-02FA-4510-9370-C892F9B24490}	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50BB4542-DF13-4db8-B163-25AA1508EDDE}	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}\stubpath = "C:\\Windows\\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe"	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5792C002-2234-480b-9CB9-6777361016E0}	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}\stubpath = "C:\\Windows\\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe"	{5792C002-2234-480b-9CB9-6777361016E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}\stubpath = "C:\\Windows\\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe"	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D652F90D-0E16-45f7-98A9-AEF786B20496}	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}\stubpath = "C:\\Windows\\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe"	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE04062-02FA-4510-9370-C892F9B24490}\stubpath = "C:\\Windows\\{1EE04062-02FA-4510-9370-C892F9B24490}.exe"	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50439C6A-0BD4-4b5c-8232-730565584709}\stubpath = "C:\\Windows\\{50439C6A-0BD4-4b5c-8232-730565584709}.exe"	{1EE04062-02FA-4510-9370-C892F9B24490}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40680F4C-E230-42c5-B606-588EB31BF2F6}\stubpath = "C:\\Windows\\{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe"	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50439C6A-0BD4-4b5c-8232-730565584709}	{1EE04062-02FA-4510-9370-C892F9B24490}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}\stubpath = "C:\\Windows\\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe"	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}	{5792C002-2234-480b-9CB9-6777361016E0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}\stubpath = "C:\\Windows\\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe"	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D652F90D-0E16-45f7-98A9-AEF786B20496}\stubpath = "C:\\Windows\\{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe"	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe

Executes dropped EXE 12 IoCs

pid	Process
1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe
3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
4320	{1EE04062-02FA-4510-9370-C892F9B24490}.exe
968	{50439C6A-0BD4-4b5c-8232-730565584709}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
File created	C:\Windows\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
File created	C:\Windows\{5792C002-2234-480b-9CB9-6777361016E0}.exe	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
File created	C:\Windows\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
File created	C:\Windows\{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
File created	C:\Windows\{50439C6A-0BD4-4b5c-8232-730565584709}.exe	{1EE04062-02FA-4510-9370-C892F9B24490}.exe
File created	C:\Windows\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
File created	C:\Windows\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	{5792C002-2234-480b-9CB9-6777361016E0}.exe
File created	C:\Windows\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
File created	C:\Windows\{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
File created	C:\Windows\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
File created	C:\Windows\{1EE04062-02FA-4510-9370-C892F9B24490}.exe	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
Token: SeIncBasePriorityPrivilege	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
Token: SeIncBasePriorityPrivilege	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
Token: SeIncBasePriorityPrivilege	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
Token: SeIncBasePriorityPrivilege	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe
Token: SeIncBasePriorityPrivilege	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
Token: SeIncBasePriorityPrivilege	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
Token: SeIncBasePriorityPrivilege	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
Token: SeIncBasePriorityPrivilege	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
Token: SeIncBasePriorityPrivilege	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
Token: SeIncBasePriorityPrivilege	3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
Token: SeIncBasePriorityPrivilege	4320	{1EE04062-02FA-4510-9370-C892F9B24490}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1864	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	84
PID 3652 wrote to memory of 1864	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	84
PID 3652 wrote to memory of 1864	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	84
PID 3652 wrote to memory of 3976	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	85
PID 3652 wrote to memory of 3976	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	85
PID 3652 wrote to memory of 3976	3652	5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe	85
PID 1864 wrote to memory of 100	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	86
PID 1864 wrote to memory of 100	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	86
PID 1864 wrote to memory of 100	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	86
PID 1864 wrote to memory of 1420	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	87
PID 1864 wrote to memory of 1420	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	87
PID 1864 wrote to memory of 1420	1864	{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe	87
PID 100 wrote to memory of 1424	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	91
PID 100 wrote to memory of 1424	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	91
PID 100 wrote to memory of 1424	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	91
PID 100 wrote to memory of 3564	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	92
PID 100 wrote to memory of 3564	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	92
PID 100 wrote to memory of 3564	100	{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe	92
PID 1424 wrote to memory of 3232	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	93
PID 1424 wrote to memory of 3232	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	93
PID 1424 wrote to memory of 3232	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	93
PID 1424 wrote to memory of 4376	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	94
PID 1424 wrote to memory of 4376	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	94
PID 1424 wrote to memory of 4376	1424	{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe	94
PID 3232 wrote to memory of 3468	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	95
PID 3232 wrote to memory of 3468	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	95
PID 3232 wrote to memory of 3468	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	95
PID 3232 wrote to memory of 1576	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	96
PID 3232 wrote to memory of 1576	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	96
PID 3232 wrote to memory of 1576	3232	{5792C002-2234-480b-9CB9-6777361016E0}.exe	96
PID 3468 wrote to memory of 1192	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	97
PID 3468 wrote to memory of 1192	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	97
PID 3468 wrote to memory of 1192	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	97
PID 3468 wrote to memory of 1148	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	98
PID 3468 wrote to memory of 1148	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	98
PID 3468 wrote to memory of 1148	3468	{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe	98
PID 1192 wrote to memory of 3196	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	99
PID 1192 wrote to memory of 3196	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	99
PID 1192 wrote to memory of 3196	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	99
PID 1192 wrote to memory of 5064	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	100
PID 1192 wrote to memory of 5064	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	100
PID 1192 wrote to memory of 5064	1192	{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe	100
PID 3196 wrote to memory of 2336	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	101
PID 3196 wrote to memory of 2336	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	101
PID 3196 wrote to memory of 2336	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	101
PID 3196 wrote to memory of 2836	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	102
PID 3196 wrote to memory of 2836	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	102
PID 3196 wrote to memory of 2836	3196	{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe	102
PID 2336 wrote to memory of 1344	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	103
PID 2336 wrote to memory of 1344	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	103
PID 2336 wrote to memory of 1344	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	103
PID 2336 wrote to memory of 3716	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	104
PID 2336 wrote to memory of 3716	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	104
PID 2336 wrote to memory of 3716	2336	{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe	104
PID 1344 wrote to memory of 3312	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	105
PID 1344 wrote to memory of 3312	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	105
PID 1344 wrote to memory of 3312	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	105
PID 1344 wrote to memory of 1328	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	106
PID 1344 wrote to memory of 1328	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	106
PID 1344 wrote to memory of 1328	1344	{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe	106
PID 3312 wrote to memory of 4320	3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe	107
PID 3312 wrote to memory of 4320	3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe	107
PID 3312 wrote to memory of 4320	3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe	107
PID 3312 wrote to memory of 4772	3312	{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe	108

C:\Users\Admin\AppData\Local\Temp\5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe
"C:\Users\Admin\AppData\Local\Temp\5951c5a830d9bceed02ef5bd8a31158d878310c839e2b9208bbc659121b2169b.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
  C:\Windows\{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
    C:\Windows\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:100
  - - C:\Windows\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
      C:\Windows\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Windows\{5792C002-2234-480b-9CB9-6777361016E0}.exe
        
        C:\Windows\{5792C002-2234-480b-9CB9-6777361016E0}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
        
        C:\Windows\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
        
        C:\Windows\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
        
        C:\Windows\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
        
        C:\Windows\{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
        
        C:\Windows\{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
        
        C:\Windows\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\{1EE04062-02FA-4510-9370-C892F9B24490}.exe
        
        C:\Windows\{1EE04062-02FA-4510-9370-C892F9B24490}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
        
        C:\Windows\{50439C6A-0BD4-4b5c-8232-730565584709}.exe
        
        C:\Windows\{50439C6A-0BD4-4b5c-8232-730565584709}.exe
        13⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1EE04~1.EXE > nul
        13⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0BD1~1.EXE > nul
        12⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{40680~1.EXE > nul
        11⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D652F~1.EXE > nul
        10⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E12E3~1.EXE > nul
        9⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7113~1.EXE > nul
        8⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FE753~1.EXE > nul
        7⤵
        
        PID:1148
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5792C~1.EXE > nul
        6⤵
        
        PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D93B3~1.EXE > nul
        5⤵
        
        PID:4376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E3E8C~1.EXE > nul
      4⤵
      PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{50BB4~1.EXE > nul
    3⤵
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\5951C5~1.EXE > nul
  2⤵
  PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1EE04062-02FA-4510-9370-C892F9B24490}.exe

Filesize
79KB

MD5
36fe1c392996c7d9a83d0542cf8dca31

SHA1
82ada1f8959927e2b6caf535cc614ce0701b0140

SHA256
98c3ed4054feb01f74dbce31101fb623d2841e95509d2a99d66ed497527b734c

SHA512
0a74c734c4c650ed0a535736e52bc2e7ff37f8e247c263121998e838e6acdb066624990a5758fd7d245add2c04b1ab58328f2a6a53989b57a4388890a950ef23

Download Submit
C:\Windows\{40680F4C-E230-42c5-B606-588EB31BF2F6}.exe

Filesize
79KB

MD5
678e8958f10175bcf02a7f1813c5c6aa

SHA1
d0698cbd79db530027a0de39f77db77b237a45ce

SHA256
dfdf8074194742b6070c2181dee3410d065928b032fe05172f0775a92da023e8

SHA512
38ff5a75f1efebc03c609f98a0f2d56bfcffc85745d8a8927303177287f50a0871b6eb6f6813caf35929f2442a3281c48ef1d65f7f4ed789bea8cf5af09118d8

Download Submit
C:\Windows\{50439C6A-0BD4-4b5c-8232-730565584709}.exe

Filesize
79KB

MD5
df6d14c9d79257d993ac8e7308d47006

SHA1
9eca52025a7071df4e4765b2bb01b45dbf1e4311

SHA256
d24822c3c49feeba9aec7d4a661950413f37e84f56057adb9d00614af794af22

SHA512
7bbcecd33b361057e7862cdf5c5421e782b1fc082f968d292c7beb3152b71c72a44ab028353b15d6437dce756b018c42d1780cbced4a44be10c854c8d8eac98c

Download Submit
C:\Windows\{50BB4542-DF13-4db8-B163-25AA1508EDDE}.exe

Filesize
79KB

MD5
20fdb2d89b7c26ee9f2cfde116c69fb0

SHA1
b182d9a33665d0e47d9d492a42da1ea18919a350

SHA256
bf42136d6ae629c71ab61fe7dc65c190d6f11643114e8c9b148504a6ae7df4d3

SHA512
0c665625a3549d01808e4dc75f436d2afa13c02092d97d10433df728d5ca679acfc02183ca33286e3c9c4192ac175008aaff62ba090445eebc234a9b5b463466

Download Submit
C:\Windows\{5792C002-2234-480b-9CB9-6777361016E0}.exe

Filesize
79KB

MD5
754a9dfd6b72887cbf542d70e09b6b8b

SHA1
03530d5110ee0909f6d10d0410c1cc21f7c9d665

SHA256
c3d01c6dfeb636ee337ad0bb1680c31fa36c0a926584eef654bdaba2a06564ef

SHA512
4d99e2867a4202f54c9e83a6f225e53344f22476153c8294c22178067c30e98ae9892044298afd4ec657777e26782eac1372ac6524b0c96f8158f7240c3f1f40

Download Submit
C:\Windows\{D0BD1C9F-258C-43bf-AEBE-DA2AE2E707FA}.exe

Filesize
79KB

MD5
685e4790dadc1a1330c2defce5e38584

SHA1
01ab30d6f8f15a71194fae95483362c5cb144131

SHA256
2f5ce0ec4275f0ba50d9db7075e5bf560e87d20f2a151308d99955df6b451de7

SHA512
7c6b77b1ea32cc95ca1380bed230df0cac5e650596d5e58c3a7f70eefa250b2d3bf23b57f8849ffa19cb85bcf6d7653be4198da0e03706a688891a4d84a9fe62

Download Submit
C:\Windows\{D652F90D-0E16-45f7-98A9-AEF786B20496}.exe

Filesize
79KB

MD5
b8b0a9c3eaf8bf31de1eee4d2c2a159e

SHA1
15184a6dc8b2fee7f7c4d36c00468e2df90603bd

SHA256
b8aa00303d5daf8c2d60ce791e4602904593d2c9736f3ebecf56e95cc9485e94

SHA512
43f4520040ee628d83a70aeda4f20902a470eb9d69429204bd22d9f4ca43dba724c8abc7879e307af2e24d9c4c76d90e306bb14cda64a0d06fd34a815eaeb878

Download Submit
C:\Windows\{D7113E89-3FAA-4d8e-B3A5-D4C956BBFACA}.exe

Filesize
79KB

MD5
c1867addb31f68aff075ad62d8e9e212

SHA1
077d8fda52d00c3cf430c1fc062cde52f88d0e58

SHA256
325946e46168af22b6e227fb929d032f16feaa2a284740c780a13d0a27cc98d1

SHA512
c3361c9798499440ccf0195edc9a85515be945688056958eb9536e2f11d45324ec140ec03d04c7702d1e07cab7c4690392fa7a110d85a4b020336863cb237f8e

Download Submit
C:\Windows\{D93B3DBC-010F-4121-9C18-DE99CC3B7D96}.exe

Filesize
79KB

MD5
3b84fabd72bed7bb504565fb3b188f6c

SHA1
60d91629e557000f5a1f2110234bd8ec17ef3801

SHA256
a15feb1eb067674d3d6986c9b6179e4702d4165da92cfff385b583078e603e53

SHA512
0a9ef4b5da9a85c80d5d59f3cf347e026179e948cd00b356ef5188f651db2874e7d697fcc51518e0adc19394c8a4664c377f43722eb89cc63bc5e6571eeb1f0c

Download Submit
C:\Windows\{E12E39F1-4A6B-4dcb-B153-1DD6C3024779}.exe

Filesize
79KB

MD5
de307542afd04e9c9cb3cb7fc52fee92

SHA1
54fcbf356256d30d0dd10738d008afc0925edc07

SHA256
7ba90838d41381d1d44190bdce5864d6d1d677de63e445c632fee7f97d4c46de

SHA512
5890b28ad8b21f8aae09cb89251b3d4fecc57fdc647b59480688d7602387846c618cd1ddec94d72402b21767cda6cfffe482483c79f5ca4f67d4fc38ab63336f

Download Submit
C:\Windows\{E3E8CEF4-26E6-4066-B656-6E9A645191FF}.exe

Filesize
79KB

MD5
ce1fa2ae437c28ee6442e1a4022ad914

SHA1
0d7cc981e113aee6cfc9e2b1f8600848b275243d

SHA256
bb42205c9f6fb844667ab4772106c1d5c06eef1d729dfea2d95c8d4baa903c7d

SHA512
9a1ea82989614205fe65b877ebbff5a40a384f351bdfaba23d26e3fa43a3f87e1c7aa4951b757d5cc59a0115154bf81d6d0076d094b113a113c9e9dea4cb73ae

Download Submit
C:\Windows\{FE753539-9B8C-4564-A98D-C17BEA9A68A0}.exe

Filesize
79KB

MD5
8ae956503eac2b7081226bba6852a00a

SHA1
52a1492ef5eb84ac6a648f5a51569504a65bf132

SHA256
3022c20c41faa085d29b5d772efecb4dc6c5dd1d366cb917b1ffd5a27046820b

SHA512
5bc8eba8cf50ed6888b6dc87c2d177f9ef50d105f06723efc82ad521fa4d6ed7c10fd2892ed267ab095aeed95a5f635ff073e4707917a661841a5666ea22f3cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads