e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
Size

89KB
MD5

928dab96bb48ea2bde1269a007dac3f8
SHA1

f8ca2ff882b5f5e43622114fdad124d769569e0b
SHA256

e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf
SHA512

17ad43a5b39e916ee1d80377ec3f03639e5aa9d20e9298d40460522af7fe381d1d4dc770b83a244bdfe4a7915ab5cd6f394fe31d99df15633c1ca72d2286b95e
SSDEEP

768:5vw9816thKQLro44/wQkNrfrunMxVFA3k:lEG/0o4lbunMxVS3k

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}\stubpath = "C:\\Windows\\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe"	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}\stubpath = "C:\\Windows\\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe"	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DFCF438D-FA9C-4534-A48E-157924540CF6}	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}\stubpath = "C:\\Windows\\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe"	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05E459B7-5D59-498d-981A-E356D3E43B11}\stubpath = "C:\\Windows\\{05E459B7-5D59-498d-981A-E356D3E43B11}.exe"	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}\stubpath = "C:\\Windows\\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe"	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}\stubpath = "C:\\Windows\\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe"	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DFCF438D-FA9C-4534-A48E-157924540CF6}\stubpath = "C:\\Windows\\{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe"	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}\stubpath = "C:\\Windows\\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe"	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}\stubpath = "C:\\Windows\\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe"	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACB4A053-C99A-406c-AC17-4B47FD531F92}	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3A608D5-9563-4208-B468-95BC7117C215}\stubpath = "C:\\Windows\\{A3A608D5-9563-4208-B468-95BC7117C215}.exe"	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05E459B7-5D59-498d-981A-E356D3E43B11}	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACB4A053-C99A-406c-AC17-4B47FD531F92}\stubpath = "C:\\Windows\\{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe"	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3A608D5-9563-4208-B468-95BC7117C215}	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe

Deletes itself 1 IoCs

pid	Process
2264	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
1604	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
1856	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
632	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
848	{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
File created	C:\Windows\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
File created	C:\Windows\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
File created	C:\Windows\{A3A608D5-9563-4208-B468-95BC7117C215}.exe	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
File created	C:\Windows\{05E459B7-5D59-498d-981A-E356D3E43B11}.exe	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
File created	C:\Windows\{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
File created	C:\Windows\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
File created	C:\Windows\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
File created	C:\Windows\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
File created	C:\Windows\{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
File created	C:\Windows\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
Token: SeIncBasePriorityPrivilege	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
Token: SeIncBasePriorityPrivilege	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
Token: SeIncBasePriorityPrivilege	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
Token: SeIncBasePriorityPrivilege	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
Token: SeIncBasePriorityPrivilege	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
Token: SeIncBasePriorityPrivilege	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
Token: SeIncBasePriorityPrivilege	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe
Token: SeIncBasePriorityPrivilege	1604	{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
Token: SeIncBasePriorityPrivilege	1856	{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
Token: SeIncBasePriorityPrivilege	632	{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2908	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	31
PID 1316 wrote to memory of 2908	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	31
PID 1316 wrote to memory of 2908	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	31
PID 1316 wrote to memory of 2908	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	31
PID 1316 wrote to memory of 2264	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	32
PID 1316 wrote to memory of 2264	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	32
PID 1316 wrote to memory of 2264	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	32
PID 1316 wrote to memory of 2264	1316	e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe	32
PID 2908 wrote to memory of 2844	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	33
PID 2908 wrote to memory of 2844	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	33
PID 2908 wrote to memory of 2844	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	33
PID 2908 wrote to memory of 2844	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	33
PID 2908 wrote to memory of 2724	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	34
PID 2908 wrote to memory of 2724	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	34
PID 2908 wrote to memory of 2724	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	34
PID 2908 wrote to memory of 2724	2908	{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe	34
PID 2844 wrote to memory of 2852	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	35
PID 2844 wrote to memory of 2852	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	35
PID 2844 wrote to memory of 2852	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	35
PID 2844 wrote to memory of 2852	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	35
PID 2844 wrote to memory of 2640	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	36
PID 2844 wrote to memory of 2640	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	36
PID 2844 wrote to memory of 2640	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	36
PID 2844 wrote to memory of 2640	2844	{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe	36
PID 2852 wrote to memory of 2616	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	37
PID 2852 wrote to memory of 2616	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	37
PID 2852 wrote to memory of 2616	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	37
PID 2852 wrote to memory of 2616	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	37
PID 2852 wrote to memory of 2676	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	38
PID 2852 wrote to memory of 2676	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	38
PID 2852 wrote to memory of 2676	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	38
PID 2852 wrote to memory of 2676	2852	{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe	38
PID 2616 wrote to memory of 264	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	39
PID 2616 wrote to memory of 264	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	39
PID 2616 wrote to memory of 264	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	39
PID 2616 wrote to memory of 264	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	39
PID 2616 wrote to memory of 832	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	40
PID 2616 wrote to memory of 832	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	40
PID 2616 wrote to memory of 832	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	40
PID 2616 wrote to memory of 832	2616	{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe	40
PID 264 wrote to memory of 624	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	41
PID 264 wrote to memory of 624	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	41
PID 264 wrote to memory of 624	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	41
PID 264 wrote to memory of 624	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	41
PID 264 wrote to memory of 2688	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	42
PID 264 wrote to memory of 2688	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	42
PID 264 wrote to memory of 2688	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	42
PID 264 wrote to memory of 2688	264	{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe	42
PID 624 wrote to memory of 1160	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	43
PID 624 wrote to memory of 1160	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	43
PID 624 wrote to memory of 1160	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	43
PID 624 wrote to memory of 1160	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	43
PID 624 wrote to memory of 2508	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	44
PID 624 wrote to memory of 2508	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	44
PID 624 wrote to memory of 2508	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	44
PID 624 wrote to memory of 2508	624	{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe	44
PID 1160 wrote to memory of 1604	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	45
PID 1160 wrote to memory of 1604	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	45
PID 1160 wrote to memory of 1604	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	45
PID 1160 wrote to memory of 1604	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	45
PID 1160 wrote to memory of 2332	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	46
PID 1160 wrote to memory of 2332	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	46
PID 1160 wrote to memory of 2332	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	46
PID 1160 wrote to memory of 2332	1160	{A3A608D5-9563-4208-B468-95BC7117C215}.exe	46

C:\Users\Admin\AppData\Local\Temp\e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe
"C:\Users\Admin\AppData\Local\Temp\e2677e02cd73646fbd848d18898f16313e210e5bf6a7f5121627a38ce7419cdf.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
  C:\Windows\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
    C:\Windows\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
      C:\Windows\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
        
        C:\Windows\{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
        
        C:\Windows\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
        
        C:\Windows\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\{A3A608D5-9563-4208-B468-95BC7117C215}.exe
        
        C:\Windows\{A3A608D5-9563-4208-B468-95BC7117C215}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
        
        C:\Windows\{05E459B7-5D59-498d-981A-E356D3E43B11}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
        
        C:\Windows\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
        
        C:\Windows\{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
        
        C:\Windows\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe
        
        C:\Windows\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ACB4A~1.EXE > nul
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8FD6~1.EXE > nul
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05E45~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3A60~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A32BB~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8C9B8~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DFCF4~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{82D7E~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{739BE~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E25C0~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\E2677E~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05E459B7-5D59-498d-981A-E356D3E43B11}.exe

Filesize
89KB

MD5
d8b4556cbf97b425301a076d1a5e4559

SHA1
70cd258bd03c0b9ff397db98be8aed82c8e9c036

SHA256
73ba726bdc75648a160982acacaeaab05d3ea32239472865b2f06e62d510847a

SHA512
fd162f1af9237949724f4d5afd7a725990e2abd8d7fcce99f299b512790b30464a50c6436dd3a1a3addcc3a35cdab5055c1558eaf153068629b67cdccbf478a3

Download Submit
C:\Windows\{739BEDD2-9A1C-4a1e-857E-B4C75C4EF032}.exe

Filesize
89KB

MD5
49bccfad22e3ee61dca99ff30007c656

SHA1
17c1fdf90aeec1953962820b5fdeb086c747c7c5

SHA256
db80046489c6b4ff1d104c98cbe49d6c7f81863a1aa46047e049231eda5d761d

SHA512
ea3eb52daa709d5de86599bcfe2d96e2c5d3c3490e203d38005c8e80591e73dbd363491f471e3ab35f1016288c03232ece3bb1adda7c990a0366d29430ea203f

Download Submit
C:\Windows\{82D7EE1C-DF8E-46e7-8E1F-F8103548EF09}.exe

Filesize
89KB

MD5
2bcd8dc57e302d8e5e83e3aff51b4802

SHA1
90c0f18dcb7837f140d77a04be11a62fa6b4dc21

SHA256
3c645d4df9460b99f7a3bdbb6be26409c5757bf41a623b9828d72a2fb0585d15

SHA512
6d990f0e663dd7b245b5113f6a39ba03534e21650b4b87542652aa4b887a401b5f23ed9ec1b335378752563c23cce951708143214ccb9e8ae46b1918d76685c6

Download Submit
C:\Windows\{8C9B8CA5-B2E6-4f87-8EE3-225184A35463}.exe

Filesize
89KB

MD5
5d5814557da8a954f46e9a75ead831f3

SHA1
3dd9ac2789f5d2e2525deeb84f63d2a2b476bd95

SHA256
469d5b14204263ca0f2bbecc1625eec2f93c57ed890a8996adeec39e9277f1a1

SHA512
34159e1d594ae30667bfe9d164f4e617f4a9e59741995a3e14f6ee198263800b6ee73685a4547ea5771333625978c2e09480a6bd6590ccfd717cbb088fce1310

Download Submit
C:\Windows\{A32BBD1F-1B90-4486-893D-E94DDA2BD1C3}.exe

Filesize
89KB

MD5
740111049ddb003ebca39787ee177c1b

SHA1
92e3e82a70ad11f32e8155796c8423d73802212a

SHA256
f3dec6d44b5c85ba75338a6119d39477eb7904a421818172ba330054ce0e5a55

SHA512
a90043490cc31ec13696b58f401b3569a992e37ec63c89dc511bd15ad0856738f16fad91f74cba03fac5108d20a9955bbc394c38c5c41ac6aaa1000ff155c686

Download Submit
C:\Windows\{A3A608D5-9563-4208-B468-95BC7117C215}.exe

Filesize
89KB

MD5
b48616b0c0cce27aa78b513fa485e8d7

SHA1
ca1502c2209f7f1b9d987d43c812b34146668dd6

SHA256
da7682ae2788f724729eff11d5f91adef1dd72609b1dd48a24f63515bdda5823

SHA512
67ceed7e78b84085d40e740835a5876c92acc5a5cb6daab453e2dd5168d7df30b51c7205e7d792bc2b2d8af2b4f684249fc966a7001664b9ffb58708e66d98af

Download Submit
C:\Windows\{ACB4A053-C99A-406c-AC17-4B47FD531F92}.exe

Filesize
89KB

MD5
ad1324a00bb0cfa8f5a290b09eb7e780

SHA1
939dd3425d4ab854ec9e2a76d5235a5f7ea41916

SHA256
b073c64ba064176964aebecfd66bdce34060a95310b175064e924cd21737edc0

SHA512
97da8b06349679f420eece437537f9c3b1c47aff0bb293e67f6d7485f79eda7255466f59956616942bc2f159f54975f766079820ef2d79256a0fb2b7530ced45

Download Submit
C:\Windows\{D4ABC83C-7E5D-4bdf-AA97-2A2EE44CD94B}.exe

Filesize
89KB

MD5
599817ebadfb1251186e3656d7b09de4

SHA1
f8b7bce0c414ebf1eca0209cf1f27d09849bb644

SHA256
06dd1892c6e300cdd56d11d1f08eebb8dac9fffbcac22c03e14d164de177684d

SHA512
3889511c5eb6f01602318000f8b6d226c8343124d5898812cd9ebbf055afc9e414aed00a60ad4516f109fe2e4dfc5727839fee6f0001c04d89cb89b174db427c

Download Submit
C:\Windows\{DFCF438D-FA9C-4534-A48E-157924540CF6}.exe

Filesize
89KB

MD5
64c7879555c9165481a7555cb83c449d

SHA1
eeb69009264d9ff875be2dc29505f75b918af6ef

SHA256
88b345b8cb715eed979d5b74e1149cfa751b6de4f34ceae9cedef7993dd14c70

SHA512
b8296ea31b3efdfc73d34a4ed247440259a429102249c1340fe4a0ae20f95f0fea2e74233fd1cfda441c86bf1383fa2f54896bee12921617379e26c49c1a2051

Download Submit
C:\Windows\{E25C0222-E5A2-4357-A7D9-63D7CC25A92E}.exe

Filesize
89KB

MD5
eb244e756993df9747f402ab6451150e

SHA1
f1f8f031e21b15e22192a07d263b256b19ccbc2c

SHA256
87fe5e980020159545ff41b94fc2cb07f959be285c7bad7a46a0a377a763b372

SHA512
be1c246472db04ed95e74c2342c45fe2658ccd6cbd72dafd91e963bfceb161e621e944c7112232bb7daffa0667a4c4ab532b978246483db6b94f32e05e5e7265

Download Submit
C:\Windows\{F8FD6552-21D8-4a0a-A2AF-1BD545C28344}.exe

Filesize
89KB

MD5
f041e678144c1e172d2107e1ed1a0ca9

SHA1
56be2110d60842754b4df5a475d5a0dfafb4a62c

SHA256
475dcb09e0093c48f8db938e34b09fcdd45b3ff37d40f31f47e1a821a8697493

SHA512
9c58d37f7a4fc9357a7356bd5a911dab92c0cb89bdf2e77fd3662677a6a533c5c1c808fd1f6cc4fb5f123d92aa963d6887711621a6fd2d1541723f269b69f5b6

Download Submit
memory/264-50-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/264-43-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/264-51-0x0000000000370000-0x0000000000381000-memory.dmp

Filesize
68KB

Download
memory/264-62-0x0000000000370000-0x0000000000381000-memory.dmp

Filesize
68KB

Download
memory/624-61-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/624-53-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/632-96-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/632-89-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1160-70-0x00000000002E0000-0x00000000002F1000-memory.dmp

Filesize
68KB

Download
memory/1160-69-0x00000000002E0000-0x00000000002F1000-memory.dmp

Filesize
68KB

Download
memory/1160-72-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1316-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1316-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1316-3-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1604-79-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1856-87-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2616-41-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2844-26-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2844-18-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2852-34-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2908-16-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2908-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads