93f649787722af9ba2af2f379aa1ec12f7396cb4e16edc0d0ac327ab84edcfc5

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
Size

22.3MB
MD5

f24ab55c8821cf9064a193daa7858f59
SHA1

02cd91240c71f441666d2c831812da99ee22732f
SHA256

93f649787722af9ba2af2f379aa1ec12f7396cb4e16edc0d0ac327ab84edcfc5
SHA512

585ab87f37f25789431fb9423a10dee4253bfad5867a51175746b58ab3d3db419659bf37b7d5d9d0cd694b0cfe483a558ca4bab5660b92a9391999d019d89958
SSDEEP

393216:oi/dD5V6dOCyWG2NIgJ5pJzdCZG82nbxocDAfl4IRkrSWXf3IdMUfAZQohXafkfb:TRjKpLBJzUGRtNa4IRkrnvYdMUfY5Xas

Score

8^/10

discovery evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
2808	7za.exe
2660	7za.exe
2880	eadApxSvr.exe
2884	eadApxSvr.exe
1484	eadApxSvr.exe
2316	iNodeSetup.exe
2032	setup.exe

Loads dropped DLL 13 IoCs

pid	Process
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2880	eadApxSvr.exe
2880	eadApxSvr.exe
2884	eadApxSvr.exe
2884	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2316	iNodeSetup.exe
2032	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
2672	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iNodeSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eadApxSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eadApxSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eadApxSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 27 IoCs

evasion

pid	Process
2188	taskkill.exe
1356	taskkill.exe
2768	taskkill.exe
1812	taskkill.exe
1980	taskkill.exe
1900	taskkill.exe
1984	taskkill.exe
1116	taskkill.exe
2164	taskkill.exe
280	taskkill.exe
2340	taskkill.exe
572	taskkill.exe
980	taskkill.exe
1532	taskkill.exe
2868	taskkill.exe
1844	taskkill.exe
1196	taskkill.exe
776	taskkill.exe
1036	taskkill.exe
2284	taskkill.exe
2512	taskkill.exe
916	taskkill.exe
2832	taskkill.exe
340	taskkill.exe
536	taskkill.exe
3056	taskkill.exe
3064	taskkill.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
1484	eadApxSvr.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	280	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	340	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	572	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2808	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	30
PID 2544 wrote to memory of 2808	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	30
PID 2544 wrote to memory of 2808	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	30
PID 2544 wrote to memory of 2808	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	30
PID 2544 wrote to memory of 2660	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	32
PID 2544 wrote to memory of 2660	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	32
PID 2544 wrote to memory of 2660	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	32
PID 2544 wrote to memory of 2660	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	32
PID 2544 wrote to memory of 2880	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	34
PID 2544 wrote to memory of 2880	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	34
PID 2544 wrote to memory of 2880	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	34
PID 2544 wrote to memory of 2880	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	34
PID 2544 wrote to memory of 2884	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	36
PID 2544 wrote to memory of 2884	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	36
PID 2544 wrote to memory of 2884	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	36
PID 2544 wrote to memory of 2884	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	36
PID 2544 wrote to memory of 1484	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	38
PID 2544 wrote to memory of 1484	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	38
PID 2544 wrote to memory of 1484	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	38
PID 2544 wrote to memory of 1484	2544	2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe	38
PID 1484 wrote to memory of 1812	1484	eadApxSvr.exe	40
PID 1484 wrote to memory of 1812	1484	eadApxSvr.exe	40
PID 1484 wrote to memory of 1812	1484	eadApxSvr.exe	40
PID 1484 wrote to memory of 1812	1484	eadApxSvr.exe	40
PID 1484 wrote to memory of 980	1484	eadApxSvr.exe	42
PID 1484 wrote to memory of 980	1484	eadApxSvr.exe	42
PID 1484 wrote to memory of 980	1484	eadApxSvr.exe	42
PID 1484 wrote to memory of 980	1484	eadApxSvr.exe	42
PID 1484 wrote to memory of 776	1484	eadApxSvr.exe	43
PID 1484 wrote to memory of 776	1484	eadApxSvr.exe	43
PID 1484 wrote to memory of 776	1484	eadApxSvr.exe	43
PID 1484 wrote to memory of 776	1484	eadApxSvr.exe	43
PID 1484 wrote to memory of 536	1484	eadApxSvr.exe	46
PID 1484 wrote to memory of 536	1484	eadApxSvr.exe	46
PID 1484 wrote to memory of 536	1484	eadApxSvr.exe	46
PID 1484 wrote to memory of 536	1484	eadApxSvr.exe	46
PID 1484 wrote to memory of 3056	1484	eadApxSvr.exe	47
PID 1484 wrote to memory of 3056	1484	eadApxSvr.exe	47
PID 1484 wrote to memory of 3056	1484	eadApxSvr.exe	47
PID 1484 wrote to memory of 3056	1484	eadApxSvr.exe	47
PID 1484 wrote to memory of 1036	1484	eadApxSvr.exe	50
PID 1484 wrote to memory of 1036	1484	eadApxSvr.exe	50
PID 1484 wrote to memory of 1036	1484	eadApxSvr.exe	50
PID 1484 wrote to memory of 1036	1484	eadApxSvr.exe	50
PID 1484 wrote to memory of 2188	1484	eadApxSvr.exe	51
PID 1484 wrote to memory of 2188	1484	eadApxSvr.exe	51
PID 1484 wrote to memory of 2188	1484	eadApxSvr.exe	51
PID 1484 wrote to memory of 2188	1484	eadApxSvr.exe	51
PID 1484 wrote to memory of 1116	1484	eadApxSvr.exe	54
PID 1484 wrote to memory of 1116	1484	eadApxSvr.exe	54
PID 1484 wrote to memory of 1116	1484	eadApxSvr.exe	54
PID 1484 wrote to memory of 1116	1484	eadApxSvr.exe	54
PID 1484 wrote to memory of 1356	1484	eadApxSvr.exe	55
PID 1484 wrote to memory of 1356	1484	eadApxSvr.exe	55
PID 1484 wrote to memory of 1356	1484	eadApxSvr.exe	55
PID 1484 wrote to memory of 1356	1484	eadApxSvr.exe	55
PID 1484 wrote to memory of 3064	1484	eadApxSvr.exe	58
PID 1484 wrote to memory of 3064	1484	eadApxSvr.exe	58
PID 1484 wrote to memory of 3064	1484	eadApxSvr.exe	58
PID 1484 wrote to memory of 3064	1484	eadApxSvr.exe	58
PID 1484 wrote to memory of 1532	1484	eadApxSvr.exe	59
PID 1484 wrote to memory of 1532	1484	eadApxSvr.exe	59
PID 1484 wrote to memory of 1532	1484	eadApxSvr.exe	59
PID 1484 wrote to memory of 1532	1484	eadApxSvr.exe	59

C:\Users\Admin\AppData\Local\Temp\2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544
- C:\tmp\iNodeSetup0\7za.exe
  C:\tmp\iNodeSetup0\7za.exe x "C:\tmp\iNodeSetup0\Qt.7z" -o"C:\tmp\iNodeSetup0" -y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\tmp\iNodeSetup0\7za.exe
  C:\tmp\iNodeSetup0\7za.exe x "C:\tmp\iNodeSetup0\tool.7z" -o"C:\tmp\iNodeSetup0" -y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\tmp\iNodeSetup0\eadApxSvr.exe
  "C:\tmp\iNodeSetup0\eadApxSvr.exe" -uninstallwmark
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\tmp\iNodeSetup0\eadApxSvr.exe
  "C:\tmp\iNodeSetup0\eadApxSvr.exe" -setUpdInfo
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2884
- C:\tmp\iNodeSetup0\eadApxSvr.exe
  "C:\tmp\iNodeSetup0\eadApxSvr.exe" -exiteadclient
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNode Client.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNode Client.ex"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeMon.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeMon.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "AuthenMngService.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "AuthenMngServic"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeImg.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeImg.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeMsg.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeMsg.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNode1x.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNode1x.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodePortal.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodePortal.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeSslvpn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeSslvpn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeWlan.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeWlan.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:280
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeSec.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeSec.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeCmn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeCmn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" delete INODE_SVR_SERVICE
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" delete INODE_SVR_MNG_SERVICE
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeMon.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeL2tpIPSecvpn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "iNodeL2tpIPSecv"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:340
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "NTChecker.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM "OpswatModule.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- C:\tmp\iNodeSetup0\iNodeSetup.exe
  "C:\tmp\iNodeSetup0\iNodeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\setup.exe
    C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\setup.exe -package:"C:\tmp\iNodeSetup0\iNodeSetup.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{35642EBE-5500-4E5B-A965-839B66F789BC}\{2DBC9F17-9894-4220-9A9C-2CF7AA59E0FD}\EulAFD5.tmp

Filesize
4KB

MD5
9e24dc4ace203e348e0390c99c194729

SHA1
8d5340ed91a8597e46903874f72e4a8f9c7466af

SHA256
a1aa68ea99a82ef61ddfcbb9f3cccff233abcbcf68c6d80b621b7f460d493536

SHA512
018d63f663b6c9c5b8e04b6d2fb49eae8991c6b8ddc0d05a5d14079d900fe9a03bf5b169352084c92b9889f95343dbb4cd01b6bdc18f4e886fb053039888d28f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\0x0404.ini

Filesize
10KB

MD5
4676329dfc858d9857e6d491e95caf31

SHA1
257e84bce804b2dc6de9c243bd723bdd97d5994d

SHA256
68daa2da6131ae26ff0d35c3c6e4f76c54b51a8cbdb0e2776703482efa765356

SHA512
fb295d2a79ee53d54662b556068760d436b3a91a4ad89d99fbd2dbd6a31f6fb02243f2da531b169c347b97ea5d79816db157d415f131e116f18f58e93fdf9fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\0x0804.ini

Filesize
10KB

MD5
ed3cf5ef1c0337b41add0a375e51a1f1

SHA1
72657bf5a04830480db22b8023c8962ffe94a5ad

SHA256
b70bdb0d16766a3272574c74ba1485d1afbaf2c7efd93574c09df759c578fb37

SHA512
a6ce191a0a5bd01409943fc35208d0791e4777b8308a6b54f8b241d994861911a7946d0eb4124bc77fa94c6efbc714535be61484982b14827da99067da8789a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\ISSetup.dll

Filesize
1.5MB

MD5
7d6bca73e4a325559afde5c87274b200

SHA1
bf12b7f1ea4e56e61b78e8694a49c5e0c426bff3

SHA256
d7c348d99d501c377880db139e7d44e43bc5bbe7d0c3f9e2f3a78c58861e2795

SHA512
da66c9da9f1bae69fcd4755cdf9b60a1cd9ffed03df0693afe735c4fb824076d467410ae8447a903fbcaf521bb0363b0c4221e2bcc36b38f1ccfcc36e369083c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\data1.cab

Filesize
2.0MB

MD5
a4b8018aa6d8940b8f24a7a6e19d52d7

SHA1
94bc86003d7561e492b85c6c34117707e6987f99

SHA256
bafe422e79e900b743ba7c610160ae863ae2e75f24bb442947c9783de5064eaf

SHA512
3472a1ed9a1617572eda94e301a0dcb954a64940d9aa1b31a7307c0571f0190e4ca2bc74fbd03c37520b1b340d2bd8605b592e3d3f35835093544cd742f5c0a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\data1.hdr

Filesize
16KB

MD5
5c81bd816db33bad0139ac405c39ce4a

SHA1
3329e1fe368d4c57bc8fe1090034e0733e664c2f

SHA256
f98697a552fc6ffd34664145c96c4a804b6230855fbcf7c1411530d67159e6a2

SHA512
ce49719a7df85bd0fb0b2c27916f745c220efe0dc9a2c7a3880d89cd757cf9e8ef1a1ee7c4c2aa2bceae9d36aa8278fa57824b99191163422557dbbdaa040c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\layout.bin

Filesize
610B

MD5
9740baad33cca12688cadcbe19f7654f

SHA1
6aa06065c8c97b13da23c0e0113063827a0c761c

SHA256
e858158bc72b0d0f1a50562705b026af85afb9c2262e462977e8c1723b82be94

SHA512
2df23eb6ccd55b556bf8294387a2d85433fe25dd6d3d83d04f57a33144e3b068187466ab6573c16824f2e503dd59dd6654f8a39fc657dfc307c0200555851f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\setup.exe

Filesize
920KB

MD5
a4c038ef4acfcc686dc267977c759cb8

SHA1
273776c8e8550193a1ccc8521ae64e53bb90fc83

SHA256
93be029fe8c55a3810f98ae543d279e6080b34242eab31fed8815cc9042fd927

SHA512
a554b0cca0f270cbd6f160465716b2de9f7473ec953de24e75ce66bc4717f29e4bdb29237cc69b265d695ab7d0753ff20f061bd82ac7622f0f2647105f0148ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\Disk1\setup.inx

Filesize
299KB

MD5
dd2293967233778c162a683fdd70ef1a

SHA1
753c435d884e33c195a906f44618db89ef29d6c1

SHA256
087e881389be5b5aceb374fc2e8b5b0062e377f8e0cbc7a7c12af89df25b9108

SHA512
3d9ec5dff233e98b4ed3876e2aa474e74a21f16c0e7a37165e374c77357aad1fe3e838acd5fcd86ede571965f74063ab61ca39f77af77100a8299a500109a270

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DBA96DF-8022-492F-9544-45856C9FC1CF}\setup.ini

Filesize
2KB

MD5
ec4c949cac954d2eb44904403271bdc2

SHA1
5611ad1372b58f61b847a39fa4e7ef6d1d069cb8

SHA256
643081beee2fcbc658d413adee3e5606974230cc9438f120f75daaa69930e279

SHA512
ed11bf429e4da8eab1a198c013aa082cf00a9dc29e9c9f2eba2a9d65b21e411916b0c2ba06383b976f475aeb3d9ead40650459bab9d2782be26ff82722555054

Download Submit
C:\iNodeLog\stp_UtlFile2024072706.log

Filesize
907B

MD5
129f5a32ebf313c6921f59bb7c84008b

SHA1
ed52e33b1c4792e1417c0d171d00d7f3b948d579

SHA256
65ba54799e607cedeb028dfe73e70198f3bfeaa7225f473ac3658f120be22503

SHA512
25911cecbb3b853382668e5a92a4d1fabf97dc7ac3d58badd68865e496e584ecfaa69c4c634e2be33e59f5877e879a530178487d32b6f04b60dd306233d15e1d

Download Submit
C:\iNodeLog\stp_setup2024072706.log

Filesize
1KB

MD5
ed065199ef3de6fc9215a297406c9703

SHA1
c708f45530bad95c0887363cce43ad01b578160a

SHA256
0aa0d73684eae564e7e26d0e4191a870ea1722bd63c7fd69dd0553191daf1472

SHA512
651a01ac91e358d3631eaf5a246a53766ed35e571bdb94eaac34c4857a30af7a577d68f03136e98e2b311d9a4ed26dc6b5c605fa9a7a1dbb3fe51f94def2b282

Download Submit
C:\tmp\iNodeSetup0\7000-1cfg.xml

Filesize
979B

MD5
f8da8fc765c113aca84f2ef2876f6226

SHA1
1c712e8019cf142cac956c269ba979eb7fd9fa4e

SHA256
f407a7c48dc066252dda895a31ea2393b91fad516d04fd77e43de00674507550

SHA512
d3d83df96c464135095fbc3d79f8672a11e10dd0868f4f1d9cc16faba3316aafce929b483ce32ebd54ab2f778235618a2c3f03ba477aa7927f6f1c6d9c5b020c

Download Submit
C:\tmp\iNodeSetup0\Log\eadApxSvr.2024072706.log

Filesize
641B

MD5
f83f31a4777c99f30f34d00ac7a3cf10

SHA1
c022a0ed3468056950746aa148c3bfee5c0ba6e8

SHA256
511b5d50781a5fae6b2a61670775321c42eb1145f61913c12e4c210fde249af2

SHA512
2693cc62612061e767fc40d9343b99c31459023b9cacb9245dfc3650abbb9b21831da0e6b6728f9bfaf807e191104c1f256e71b3007a19b1eb7f5d8e5179a124

Download Submit
C:\tmp\iNodeSetup0\Log\eadApxSvr.2024072706.log

Filesize
1KB

MD5
0e476eab896b7b56719c9c59e84f224c

SHA1
29c1384b4e404c9d3259dcd190e29091bf191a70

SHA256
c194dcf9329779e8d7fb2a8e4ca08570380482f4592f47626c98e44130266f03

SHA512
2758fa202fb6aebc0f6764d56c8ad5a3119d197297427aa898f1127844822033240bae42fc0c66fa0459761e03e50a12a49ecaceea1b4872bcb23ad776f94dcf

Download Submit
C:\tmp\iNodeSetup0\MSVCP100.dll

Filesize
411KB

MD5
03e9314004f504a14a61c3d364b62f66

SHA1
0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d

SHA256
a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f

SHA512
2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d

Download Submit
C:\tmp\iNodeSetup0\MSVCR100.dll

Filesize
752KB

MD5
67ec459e42d3081dd8fd34356f7cafc1

SHA1
1738050616169d5b17b5adac3ff0370b8c642734

SHA256
1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067

SHA512
9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33

Download Submit
C:\tmp\iNodeSetup0\Qt.7z

Filesize
10.4MB

MD5
82a08a02e6309361d87a8602d810a85e

SHA1
2e4b548bf3caa7655e3b657526bdb8e8a6009745

SHA256
9c83f779c1af5a70ddeaa608612c5eb36f6c9ad7521070ee312333251364d8ea

SHA512
66d9cded9f402b16672f225364e3f79c8482ed74cdb8828b70ea5ec602a1b0491030aecb99dd4ae6de775097c0c98298acde4cfb659db64ad39e2181d74ca1cf

Download Submit
C:\tmp\iNodeSetup0\Tool.7z

Filesize
3.4MB

MD5
12efbf24760589be65c813a0e7fff20c

SHA1
672542c548f4d8f09e40777ca0863ac928a30685

SHA256
82fe32dfa8c087693b35e2de64e6174e5c3bc15a46a90eed23dcde021302e854

SHA512
203845a6e158ac9275658b2972148f6b9504720bc73f3b2cb484ea5dfa83583bcc24ad064725bcc5dc2077748402cf518f35e25dde696e738efb2333877fa058

Download Submit
C:\tmp\iNodeSetup0\conn_cfg.ini

Filesize
56B

MD5
58771f3f6f5c0805bc8ef4c47c296572

SHA1
7d19d6bfccaeee142ada6d69e6a181f7abf566a1

SHA256
b89cfc128d42f5b282f653bfe8aaadd648e6c9a278793de2c0aacc298d456e88

SHA512
38f38a796a158ea3dcb40c5b4280882403bfb7427aafd09edd5240199c8a1fd550d6b6cf1d188746d5a454393d681056b4c67d249b639d1a760e1b13a3571818

Download Submit
C:\tmp\iNodeSetup0\eadApxSvr.exe

Filesize
774KB

MD5
371b0c6f6a919ec440003bbea799d921

SHA1
1b761dd53e1317ac8ff0d36345d74731050830ae

SHA256
509ca37e6639f373b8d9bd31ee58e6020778ea814e584bfc09cfcaaf2bc51b97

SHA512
66cfda5a5a0fd41d2bff48385596e54bac052de8b5b7c9d4d58320befc1f644d411241e5a494de2a3de6d453c4ea230f49ddba190121e2fe5db43b26f2a65a00

Download Submit
C:\tmp\iNodeSetup0\iNodeSetup.exe

Filesize
5.7MB

MD5
42800aaad89bc65c5c41f7a96405a35f

SHA1
bcfcbf0d88449a5a8111a451e3d181eede998525

SHA256
46e9a2c36e29cc8563462caeaceb8a740ba7f44c6d5fbb00c26dd5da66bb5933

SHA512
73b1c8b8d3c0b4e91494fe7743c6d441b7249256a4871709d208af939343650a5863e79c8a22ef40c67488c99837ed2e88eddd32da3854a327812e590e7ee277

Download Submit
C:\tmp\iNodeSetup0\locations.xml

Filesize
395B

MD5
10a4d5272ba32c4f32ae5a469373b4c8

SHA1
0a9d4b35c6d7b806bcd60d76b30286e85379b121

SHA256
a83eee4b88fa8e43fff32709bc37368771f62d58991cfb16e9dd411d544d675d

SHA512
fc0a7b1d2d2d9f52a2120f958f0d195fd59d4365c40a6901d1d1912dca3ea2ae029dc27aa6d7941d6ae5b891bcd2b758c87b50b7d61cce12683bd8026d76133b

Download Submit
\tmp\iNodeSetup0\7za.exe

Filesize
529KB

MD5
83bb916b70f1ca8faec7cd6b29c1d1c7

SHA1
5c52fedc2bce4dc5d6bdb47fce71a8ac77781dab

SHA256
bab9d7a51d1366630e9a43a97808e1974ae9edd6f17384a56daefb9f5d60d7b8

SHA512
19f189b6933a8e8c97215298848f198457b49b92ef245ce5980feeae83ada127dfcd93ebb22c9cb80fb15ea3c43910133532aee5877dcf6305009adce7673ca0

Download Submit