Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 00:01
Behavioral task
behavioral1
Sample
45091dcc4a103eb84069e7e8cddb66a0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
45091dcc4a103eb84069e7e8cddb66a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
45091dcc4a103eb84069e7e8cddb66a0N.exe
-
Size
83KB
-
MD5
45091dcc4a103eb84069e7e8cddb66a0
-
SHA1
171971b49ff6102c41bd066aab434bb91fb8e562
-
SHA256
f18009dc2b6a94a2e982e72c4fe886f3eb7f2322374e8600ef18bf608cbb6cda
-
SHA512
90b3d5de07ea5d66e0408fb7dcfa7ecf46f95ee6a2eab230196ff4b4871cec06b12f8c8f86416030b5320f64bb373d369b9d2690f271c85cc0acc5f354f9866f
-
SSDEEP
1536:q4Gh0o4n0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4n05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF031698-DD3D-4e99-ABC1-047AF521D2B5}\stubpath = "C:\\Windows\\{DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe" {854AF056-85D2-4409-B838-B75552C08E22}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}\stubpath = "C:\\Windows\\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exe" {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB}\stubpath = "C:\\Windows\\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe" {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{868708F3-C476-4011-970A-6E3BAFA97965} {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE58E6EA-2D6B-4052-8086-96ED62D74E33} {868708F3-C476-4011-970A-6E3BAFA97965}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225} {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}\stubpath = "C:\\Windows\\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe" {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF031698-DD3D-4e99-ABC1-047AF521D2B5} {854AF056-85D2-4409-B838-B75552C08E22}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB} {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0}\stubpath = "C:\\Windows\\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe" {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{854AF056-85D2-4409-B838-B75552C08E22} {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C} 45091dcc4a103eb84069e7e8cddb66a0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{868708F3-C476-4011-970A-6E3BAFA97965}\stubpath = "C:\\Windows\\{868708F3-C476-4011-970A-6E3BAFA97965}.exe" {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE58E6EA-2D6B-4052-8086-96ED62D74E33}\stubpath = "C:\\Windows\\{FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe" {868708F3-C476-4011-970A-6E3BAFA97965}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0} {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{854AF056-85D2-4409-B838-B75552C08E22}\stubpath = "C:\\Windows\\{854AF056-85D2-4409-B838-B75552C08E22}.exe" {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C}\stubpath = "C:\\Windows\\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe" 45091dcc4a103eb84069e7e8cddb66a0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A} {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe -
Deletes itself 1 IoCs
pid Process 2096 cmd.exe -
Executes dropped EXE 9 IoCs
pid Process 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 1236 {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe 2516 {005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exe -
resource yara_rule behavioral1/memory/1232-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1232-1-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1232-4-0x00000000003E0000-0x00000000003F3000-memory.dmp upx behavioral1/files/0x00090000000173c2-8.dat upx behavioral1/memory/1232-10-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1144-11-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1144-15-0x00000000002A0000-0x00000000002B3000-memory.dmp upx behavioral1/memory/2872-21-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1144-19-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x0004000000004ed7-20.dat upx behavioral1/files/0x000a0000000173c2-30.dat upx behavioral1/memory/2872-31-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2720-32-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2720-39-0x0000000000550000-0x0000000000563000-memory.dmp upx behavioral1/files/0x0005000000004ed7-42.dat upx behavioral1/memory/2720-41-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2616-43-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2616-52-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x000b0000000173c2-53.dat upx behavioral1/memory/2820-54-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x0006000000004ed7-64.dat upx behavioral1/memory/932-65-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2820-63-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x000c0000000173c2-75.dat upx behavioral1/memory/932-74-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1612-76-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1612-83-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x0007000000004ed7-84.dat upx behavioral1/memory/1236-85-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1236-92-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/files/0x000d0000000173c2-93.dat upx behavioral1/memory/2516-94-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe File created C:\Windows\{868708F3-C476-4011-970A-6E3BAFA97965}.exe {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe File created C:\Windows\{FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe {868708F3-C476-4011-970A-6E3BAFA97965}.exe File created C:\Windows\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe File created C:\Windows\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe File created C:\Windows\{854AF056-85D2-4409-B838-B75552C08E22}.exe {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe File created C:\Windows\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 45091dcc4a103eb84069e7e8cddb66a0N.exe File created C:\Windows\{DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe {854AF056-85D2-4409-B838-B75552C08E22}.exe File created C:\Windows\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exe {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45091dcc4a103eb84069e7e8cddb66a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {854AF056-85D2-4409-B838-B75552C08E22}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {868708F3-C476-4011-970A-6E3BAFA97965}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe Token: SeIncBasePriorityPrivilege 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe Token: SeIncBasePriorityPrivilege 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe Token: SeIncBasePriorityPrivilege 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe Token: SeIncBasePriorityPrivilege 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe Token: SeIncBasePriorityPrivilege 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe Token: SeIncBasePriorityPrivilege 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe Token: SeIncBasePriorityPrivilege 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe Token: SeIncBasePriorityPrivilege 1236 {DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1144 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 31 PID 1232 wrote to memory of 1144 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 31 PID 1232 wrote to memory of 1144 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 31 PID 1232 wrote to memory of 1144 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 31 PID 1232 wrote to memory of 2096 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 32 PID 1232 wrote to memory of 2096 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 32 PID 1232 wrote to memory of 2096 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 32 PID 1232 wrote to memory of 2096 1232 45091dcc4a103eb84069e7e8cddb66a0N.exe 32 PID 1144 wrote to memory of 2872 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 33 PID 1144 wrote to memory of 2872 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 33 PID 1144 wrote to memory of 2872 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 33 PID 1144 wrote to memory of 2872 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 33 PID 1144 wrote to memory of 2892 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 34 PID 1144 wrote to memory of 2892 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 34 PID 1144 wrote to memory of 2892 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 34 PID 1144 wrote to memory of 2892 1144 {41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe 34 PID 2872 wrote to memory of 2720 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 35 PID 2872 wrote to memory of 2720 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 35 PID 2872 wrote to memory of 2720 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 35 PID 2872 wrote to memory of 2720 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 35 PID 2872 wrote to memory of 2800 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 36 PID 2872 wrote to memory of 2800 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 36 PID 2872 wrote to memory of 2800 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 36 PID 2872 wrote to memory of 2800 2872 {37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe 36 PID 2720 wrote to memory of 2616 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 37 PID 2720 wrote to memory of 2616 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 37 PID 2720 wrote to memory of 2616 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 37 PID 2720 wrote to memory of 2616 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 37 PID 2720 wrote to memory of 2668 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 38 PID 2720 wrote to memory of 2668 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 38 PID 2720 wrote to memory of 2668 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 38 PID 2720 wrote to memory of 2668 2720 {868708F3-C476-4011-970A-6E3BAFA97965}.exe 38 PID 2616 wrote to memory of 2820 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 39 PID 2616 wrote to memory of 2820 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 39 PID 2616 wrote to memory of 2820 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 39 PID 2616 wrote to memory of 2820 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 39 PID 2616 wrote to memory of 1660 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 40 PID 2616 wrote to memory of 1660 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 40 PID 2616 wrote to memory of 1660 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 40 PID 2616 wrote to memory of 1660 2616 {FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe 40 PID 2820 wrote to memory of 932 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 41 PID 2820 wrote to memory of 932 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 41 PID 2820 wrote to memory of 932 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 41 PID 2820 wrote to memory of 932 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 41 PID 2820 wrote to memory of 2832 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 42 PID 2820 wrote to memory of 2832 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 42 PID 2820 wrote to memory of 2832 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 42 PID 2820 wrote to memory of 2832 2820 {4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe 42 PID 932 wrote to memory of 1612 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 43 PID 932 wrote to memory of 1612 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 43 PID 932 wrote to memory of 1612 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 43 PID 932 wrote to memory of 1612 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 43 PID 932 wrote to memory of 2024 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 44 PID 932 wrote to memory of 2024 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 44 PID 932 wrote to memory of 2024 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 44 PID 932 wrote to memory of 2024 932 {E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe 44 PID 1612 wrote to memory of 1236 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 45 PID 1612 wrote to memory of 1236 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 45 PID 1612 wrote to memory of 1236 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 45 PID 1612 wrote to memory of 1236 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 45 PID 1612 wrote to memory of 2328 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 46 PID 1612 wrote to memory of 2328 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 46 PID 1612 wrote to memory of 2328 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 46 PID 1612 wrote to memory of 2328 1612 {854AF056-85D2-4409-B838-B75552C08E22}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\45091dcc4a103eb84069e7e8cddb66a0N.exe"C:\Users\Admin\AppData\Local\Temp\45091dcc4a103eb84069e7e8cddb66a0N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exeC:\Windows\{41DB7123-75ED-4480-9DE4-A7FA1D65A48C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exeC:\Windows\{37243D7E-FF71-4c75-86E9-7AE94B0A77CB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\{868708F3-C476-4011-970A-6E3BAFA97965}.exeC:\Windows\{868708F3-C476-4011-970A-6E3BAFA97965}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\{FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exeC:\Windows\{FE58E6EA-2D6B-4052-8086-96ED62D74E33}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exeC:\Windows\{4159B14E-4949-4402-AC2A-7DC9BEFC77A0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exeC:\Windows\{E4652A8C-EEB1-4bb0-A5D0-B62407C6B225}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\{854AF056-85D2-4409-B838-B75552C08E22}.exeC:\Windows\{854AF056-85D2-4409-B838-B75552C08E22}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\{DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exeC:\Windows\{DF031698-DD3D-4e99-ABC1-047AF521D2B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exeC:\Windows\{005A83FB-2B81-4e32-ABBD-6B88BBACAB1A}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF031~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{854AF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:2328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4652~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4159B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE58E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86870~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37243~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41DB7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\45091D~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD56746b8f3d250cc34ce086afd4650158e
SHA1688c7913b68a8253cf751e2f129131d33cc561a2
SHA2565768741f3c87506449a6a7d925e6d726eacdc19a1489c85748c2aaf2c9716094
SHA5128f613998ca3ea486d9c56d576b8cb0b00adcf54723b7e87e0f43d0a1c49f25e564e51fd1b7d39f850fa1d68c8d251f2330107a4eedb5e71cb23795a278d27326
-
Filesize
83KB
MD52c503590ce94788cf45f3d734e9654e9
SHA1a2ebeb1110240e7c3a5f689708abcda63e581433
SHA25617d470b679e995d171ac00bd6b8a7eb6c3aa079d891056d40f6b553c706e7b86
SHA5123fc2a98298e18957ae09500e6ea4be345ef22968d6dcdff674edd1cc553955dff041c862d06d39f337546c5a4aad5c306d47c42c314113b4ed5097222268b257
-
Filesize
83KB
MD5c5875ae36bfe5612f540a9fd1556e142
SHA11856f4ed90944834e75ea42a826446cb9a7e02bd
SHA2566c3e4df83c54f448652cd9c729aec9071a92b7f8c81d347a5183956a23b4291b
SHA512d9763018ce2897d7a8d719cceae524e04909624690888a4380da9d66b31d91ea9807100821165fc86798441c004302f2c1546662967fb63ce2f0fbd9f3a5359e
-
Filesize
83KB
MD5420d1c7d9f99ae38d9f144019ea2110b
SHA11afa3c25ba827c64477c23d96664e3f4ab237bed
SHA256f4e1a834bd619c84ea2cf09d4b416f611b5354dd5821f38faf00d8079567a83d
SHA51205b939f19b24a47e3294bdb00efb207a26c8b54fb7a1da607958b54ab49b567402abd77eb20d60640a6505ab98be15a20c99b98ee8ae06e1e2eab5eadb051daf
-
Filesize
83KB
MD537b1a6c627b78e9bd24dd608d930ee78
SHA1799f0e4883ba07144ebd8613975c375c2bbfdb03
SHA256c417f40e5070b725dd7aad1d3ebc5c674a021c932d38a10b4d6de01866148618
SHA512fb573cfed26705fe1f981e33994e0625e467be25c1637cfc52eaf8ef6bac732a5dab8aa93e5d1db80dccc5a49b7c2d866a9eeaba0371250d17f2b19a30009628
-
Filesize
83KB
MD591bc3ac1a04617379e7910b5f1a62f1a
SHA1697bd492e0cea2611695b9e09a6a7422493d320f
SHA25615da0f0d0b3225283959a1b4bfd443c5f61bfd890bba80cee1ff410529797a65
SHA5129f3ee951cb703c21d1fe46f042cf02bba9841b97b8286f2bef3af2847232cf7d268961d09beadea8a33af58835bc097f202934c926a667b3b9b840ecdd838528
-
Filesize
83KB
MD5aac8fa2d37367f74a057362bfde39cb3
SHA1310ae0a04ff22fcd6a374bb37a623f35d257efbe
SHA256133af9ae16f16a5cb1817a2bf123ab5be530a00db2bd09755f2143db7f6cbb36
SHA5121db65d26753e0b288c1b73abf0f269dadd223fe2f2551f86da2bb5873b3a98deaf60328f373770d234141d87db2681c7f21daf2b81b9ef61d41ab4337480feaf
-
Filesize
83KB
MD5a50986a2dc9e397f05122ea58115fb45
SHA1405138a77481c8116249519351ffdefec5c9d480
SHA256a0a36788f5659b19c178abc548657fd4b8c05e6a7e9b3f9ca12bc20b80f83c1b
SHA512959f9b461ebe7697568ae21f70457b347899feeaad4f1094f3e40dbf1a5b9c032cc5e16421de8cbc9d5bab15b61282394eeb719c62152d8f06d323b59288f782
-
Filesize
83KB
MD5813eb5750baffdc42397f52501a3880d
SHA14de76393e5c351a1094083352dd7aa161c88b878
SHA256f62b8425256ec13c3232059fb2e85fb764a9e4310bfbbb69706a21c6baf7e15b
SHA51277cdebdf4b1c5c06492f02d7bd18fa0d4ca0a4f85476213eaf005311e5d4138b600fa59a3c60cd3d367222cebda4a1ebe67b1a3b81e333d1e9313a5817f8bceb