Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
efa16d4fe3e1d09cf2fbde61533a54f0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
efa16d4fe3e1d09cf2fbde61533a54f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
efa16d4fe3e1d09cf2fbde61533a54f0N.exe
-
Size
64KB
-
MD5
efa16d4fe3e1d09cf2fbde61533a54f0
-
SHA1
8242770a1c6bba119c32c6ea3edaed0b401a90e9
-
SHA256
5f251260a5c406ac446459cd515c78f6f769aa396c3252ca0858516a5335c24d
-
SHA512
ef5cc9f41662c14cba96b0a765f569486f2dff5f77286232eb6675a70ad26508a51012bc3bf6093807678d6838f16987d6d58338138354357e182930a1ea6d1e
-
SSDEEP
384:ObLwOs8AHsc42MfwhKQLroI4/CFsrdHWMZE:Ovw981EvhKQLroI4/wQpWMZE
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{382AD308-31D8-475d-8DCE-3F543FDB84A5} {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78F55CA7-C526-43a6-B68C-804009DE39E8} {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC}\stubpath = "C:\\Windows\\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe" {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF} {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1}\stubpath = "C:\\Windows\\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe" {02C13B47-CBBC-4498-8860-AFB125038727}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF00F8A-143A-44ba-B387-A35284E95BC3}\stubpath = "C:\\Windows\\{6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe" efa16d4fe3e1d09cf2fbde61533a54f0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF}\stubpath = "C:\\Windows\\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe" {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02C13B47-CBBC-4498-8860-AFB125038727} {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02C13B47-CBBC-4498-8860-AFB125038727}\stubpath = "C:\\Windows\\{02C13B47-CBBC-4498-8860-AFB125038727}.exe" {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1} {02C13B47-CBBC-4498-8860-AFB125038727}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}\stubpath = "C:\\Windows\\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe" {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF00F8A-143A-44ba-B387-A35284E95BC3} efa16d4fe3e1d09cf2fbde61533a54f0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{382AD308-31D8-475d-8DCE-3F543FDB84A5}\stubpath = "C:\\Windows\\{382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe" {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC} {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7} {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E340952-82B7-4262-90C6-82730E175987} {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78F55CA7-C526-43a6-B68C-804009DE39E8}\stubpath = "C:\\Windows\\{78F55CA7-C526-43a6-B68C-804009DE39E8}.exe" {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E340952-82B7-4262-90C6-82730E175987}\stubpath = "C:\\Windows\\{8E340952-82B7-4262-90C6-82730E175987}.exe" {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe -
Executes dropped EXE 9 IoCs
pid Process 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 4068 {8E340952-82B7-4262-90C6-82730E175987}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe File created C:\Windows\{02C13B47-CBBC-4498-8860-AFB125038727}.exe {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe File created C:\Windows\{382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe File created C:\Windows\{78F55CA7-C526-43a6-B68C-804009DE39E8}.exe {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe File created C:\Windows\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe File created C:\Windows\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe {02C13B47-CBBC-4498-8860-AFB125038727}.exe File created C:\Windows\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe File created C:\Windows\{8E340952-82B7-4262-90C6-82730E175987}.exe {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe File created C:\Windows\{6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe efa16d4fe3e1d09cf2fbde61533a54f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {8E340952-82B7-4262-90C6-82730E175987}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {02C13B47-CBBC-4498-8860-AFB125038727}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efa16d4fe3e1d09cf2fbde61533a54f0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe Token: SeIncBasePriorityPrivilege 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe Token: SeIncBasePriorityPrivilege 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe Token: SeIncBasePriorityPrivilege 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe Token: SeIncBasePriorityPrivilege 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe Token: SeIncBasePriorityPrivilege 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe Token: SeIncBasePriorityPrivilege 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe Token: SeIncBasePriorityPrivilege 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe Token: SeIncBasePriorityPrivilege 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3916 wrote to memory of 2212 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 94 PID 3916 wrote to memory of 2212 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 94 PID 3916 wrote to memory of 2212 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 94 PID 3916 wrote to memory of 448 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 95 PID 3916 wrote to memory of 448 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 95 PID 3916 wrote to memory of 448 3916 efa16d4fe3e1d09cf2fbde61533a54f0N.exe 95 PID 2212 wrote to memory of 3476 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 96 PID 2212 wrote to memory of 3476 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 96 PID 2212 wrote to memory of 3476 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 96 PID 2212 wrote to memory of 3576 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 97 PID 2212 wrote to memory of 3576 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 97 PID 2212 wrote to memory of 3576 2212 {6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe 97 PID 3476 wrote to memory of 3104 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 100 PID 3476 wrote to memory of 3104 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 100 PID 3476 wrote to memory of 3104 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 100 PID 3476 wrote to memory of 3256 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 101 PID 3476 wrote to memory of 3256 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 101 PID 3476 wrote to memory of 3256 3476 {382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe 101 PID 3104 wrote to memory of 2584 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 102 PID 3104 wrote to memory of 2584 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 102 PID 3104 wrote to memory of 2584 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 102 PID 3104 wrote to memory of 3236 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 103 PID 3104 wrote to memory of 3236 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 103 PID 3104 wrote to memory of 3236 3104 {78F55CA7-C526-43a6-B68C-804009DE39E8}.exe 103 PID 2584 wrote to memory of 3820 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 104 PID 2584 wrote to memory of 3820 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 104 PID 2584 wrote to memory of 3820 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 104 PID 2584 wrote to memory of 3744 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 105 PID 2584 wrote to memory of 3744 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 105 PID 2584 wrote to memory of 3744 2584 {BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe 105 PID 3820 wrote to memory of 4564 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 106 PID 3820 wrote to memory of 4564 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 106 PID 3820 wrote to memory of 4564 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 106 PID 3820 wrote to memory of 3684 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 107 PID 3820 wrote to memory of 3684 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 107 PID 3820 wrote to memory of 3684 3820 {0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe 107 PID 4564 wrote to memory of 4428 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 108 PID 4564 wrote to memory of 4428 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 108 PID 4564 wrote to memory of 4428 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 108 PID 4564 wrote to memory of 4364 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 109 PID 4564 wrote to memory of 4364 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 109 PID 4564 wrote to memory of 4364 4564 {02C13B47-CBBC-4498-8860-AFB125038727}.exe 109 PID 4428 wrote to memory of 4036 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 110 PID 4428 wrote to memory of 4036 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 110 PID 4428 wrote to memory of 4036 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 110 PID 4428 wrote to memory of 640 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 111 PID 4428 wrote to memory of 640 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 111 PID 4428 wrote to memory of 640 4428 {6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe 111 PID 4036 wrote to memory of 4068 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 112 PID 4036 wrote to memory of 4068 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 112 PID 4036 wrote to memory of 4068 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 112 PID 4036 wrote to memory of 3272 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 113 PID 4036 wrote to memory of 3272 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 113 PID 4036 wrote to memory of 3272 4036 {E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\efa16d4fe3e1d09cf2fbde61533a54f0N.exe"C:\Users\Admin\AppData\Local\Temp\efa16d4fe3e1d09cf2fbde61533a54f0N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\{6EF00F8A-143A-44ba-B387-A35284E95BC3}.exeC:\Windows\{6EF00F8A-143A-44ba-B387-A35284E95BC3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\{382AD308-31D8-475d-8DCE-3F543FDB84A5}.exeC:\Windows\{382AD308-31D8-475d-8DCE-3F543FDB84A5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\{78F55CA7-C526-43a6-B68C-804009DE39E8}.exeC:\Windows\{78F55CA7-C526-43a6-B68C-804009DE39E8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exeC:\Windows\{BFCCC500-9FC7-4846-95E5-B96ACD299CAC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exeC:\Windows\{0D657F38-1FB6-40fa-A0A4-FA006874B9DF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\{02C13B47-CBBC-4498-8860-AFB125038727}.exeC:\Windows\{02C13B47-CBBC-4498-8860-AFB125038727}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exeC:\Windows\{6CD11CB9-40B5-4cb9-AC24-15C7996834E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exeC:\Windows\{E1979A8A-8CE1-45f4-AB9B-3E5AA59E03E7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\{8E340952-82B7-4262-90C6-82730E175987}.exeC:\Windows\{8E340952-82B7-4262-90C6-82730E175987}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1979~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:3272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CD11~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02C13~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D657~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:3684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFCCC~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:3744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78F55~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:3236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{382AD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:3256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EF00~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:3576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EFA16D~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f63a52fccd0025868f764fe4cbefd588
SHA1750b7a1901079de46f1b95babf527ef9cf03a3a4
SHA256fca40b6baf529a4529f48ab2dd610178156ce4f43e56215bea04e649f6be1f31
SHA512f104b7e5315efefda7d3373adbf074117f7262874b6840a4624971197c7383b0001fa1fafaf3414b4ea2337101d2581e9d7663e4182a6e92dccda982120d9b25
-
Filesize
64KB
MD5bd5c01afe71555e5f91f317d3d689e26
SHA15cdf82d488b38863c9f139e5045bee2927c97ade
SHA256c581e18e6fbdeac1b87e13b2f69bdeffe311b8b363b1a446313392390421b4d4
SHA512018917969b1a1810eda3e39c58b2339ca0caa0bfa8cc1add5935d52805a0363eb6df59854744318dc89513da73a58cc984380eef2429022ed9be6d8f3d0027c4
-
Filesize
64KB
MD5ba83b303cb8e07df683321fa01ee0a88
SHA1962b4da931beb558827bd8b6038bf99aac0365ac
SHA2567c74d0c178075530f11e32a123b3256db64cf415c1c3390185144927847bba3b
SHA51273dd7321a8c524ae1b89e5460a037456fd6d52f9ad8a9594df5e74ca3e001abcf553e907dbd1785b400ad81d158eb3055658538008c380c689852b554789e5d8
-
Filesize
64KB
MD56ed701142a567803304b1493c50b5d69
SHA10c23fba3b4fe161d03b3ba3cf5650ce78c3cfdb4
SHA256dba1f610e5acd64bbe54e4f361dd929eafe2eb6e172b90ce1f9c7c593822430a
SHA5120958ffbd084c66a1ae04273a280197df56e70473d7789593f759dc2f71c461d5c58ce1ef112d397cc1deb4c4debb0372a38fd21d6afccbb04995a56b4a771210
-
Filesize
64KB
MD55cbd2a9d35960f6077e6b5cb2e8bc81a
SHA15c9eb4f0d9d75b7d6b089f5a3982958b5df6e6d1
SHA2568b030877a9eaf15c7b0ee0a3fa08cc97b6f8690e6dfc36cf64e95a3c6a7ec90e
SHA5128775ea6a53d68aaf015e4ca4de1d1db960b09fd9955ab2b71022fb0d6e79b6bdfacb4525196ed784371b64c010850a082cc70eba7f335ffb3e5d51ec318eed4f
-
Filesize
64KB
MD5923020af122998c4a547eeb610881bfd
SHA137833c5d4346ad7c5e91f77b8c1e3feab025680f
SHA25640ce163c9d40c3449c574851cf41e5333c9a44f14bdba56053393f5429cd7bd4
SHA512e1d5efc88b1e94887f098eb44f0897e7a4dae00aeef92aaaa874b2e7483af8a679c9d93f468ffd89f40709e42c868615a0ca104867cc66bf945b9335ffedfd65
-
Filesize
64KB
MD541e20ee32ae8762e48a1424a2d671c97
SHA1f53ce762c14fe050ea96b0d3132fde798f05eb40
SHA25604345a6eaf70f2bba14bddbb9f346018d05ddf6c8df8014c8431df05a236996f
SHA512fc65fdecb3d6af330bafa0066d96ac6506eac42f92004b0f22bfc36d63b435d96e7215ecba70ef647e747b1cb601e0edcb5d4b3a69ff2c8ea2f391bc5c6839c1
-
Filesize
64KB
MD52b4870e5c7fd06076a5a9b828b0da337
SHA1f11d91e46bb0e374387fc1ff56b83171af3e7e1b
SHA256a2fd602adbbe7f0c3ac5667eebed76f08268339c67e871263457713dcec843a3
SHA51244e9fa9ae73671e122fa82c89a9ec017d17a38f1fb94c5da526ab82c8537960d96a007ad9fd0a219ac6ad50912fe50e9477f6cb3656d5ee4ec91f8a77b6b42c2
-
Filesize
64KB
MD59c6b1de6bf42e36e2f818f0bc8533ed5
SHA1b114a3d7ffbe7550a35d40dde18e99b90ada458f
SHA2568741a17294114ff1139c0d4a72157642cd175f5d60aaab78de7ce27e23c1cca6
SHA5125294e771b632560aa0eedcfa729f13761ca1f1fa073c0847d6769c6f4f1f1dde04af0cac7707d3c4b92bcc4c4b2551b20b60172a501151408237dd127099d6bb