4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339

Analysis

max time kernel
107s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
Size

220KB
MD5

e700d0d7c9bcc8baf58e33747b0df4b0
SHA1

7e411f52a65e4cd92599ff86750b55a57e285724
SHA256

4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339
SHA512

6c954ef6c161cfd189bee3c50d04b723c420b2970aa4939e56201d73f53049a17d3644799b575c00ae0799026422f8afbf521856ffcd305d5364034164dd10bc
SSDEEP

3072:iNu9h3eiLZT2UTOyU2qTq/yecrqyEIlyny4iio1t1oBM9/AC99kLNh11GJ+UEtEj:lh3eeTXFUnq/yesLEoynn7BMJSXtt34

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies security service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 8 IoCs

pid	Process
2116	Tilecomgm.com
2236	Tilecomgm.com
3208	Tilecomgm.com
5036	Tilecomgm.com
2864	Tilecomgm.com
880	Tilecomgm.com
4964	Tilecomgm.com
2868	Tilecomgm.com

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com

Runs .reg file with regedit 9 IoCs

pid	Process
3312	regedit.exe
3572	regedit.exe
936	regedit.exe
4840	regedit.exe
5112	regedit.exe
2280	regedit.exe
2464	regedit.exe
5032	regedit.exe
1852	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3456	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	82
PID 3256 wrote to memory of 3456	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	82
PID 3256 wrote to memory of 3456	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	82
PID 3456 wrote to memory of 3572	3456	cmd.exe	83
PID 3456 wrote to memory of 3572	3456	cmd.exe	83
PID 3456 wrote to memory of 3572	3456	cmd.exe	83
PID 3256 wrote to memory of 2116	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	84
PID 3256 wrote to memory of 2116	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	84
PID 3256 wrote to memory of 2116	3256	4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe	84
PID 2116 wrote to memory of 3972	2116	Tilecomgm.com	85
PID 2116 wrote to memory of 3972	2116	Tilecomgm.com	85
PID 2116 wrote to memory of 3972	2116	Tilecomgm.com	85
PID 3972 wrote to memory of 936	3972	cmd.exe	86
PID 3972 wrote to memory of 936	3972	cmd.exe	86
PID 3972 wrote to memory of 936	3972	cmd.exe	86
PID 2116 wrote to memory of 2236	2116	Tilecomgm.com	94
PID 2116 wrote to memory of 2236	2116	Tilecomgm.com	94
PID 2116 wrote to memory of 2236	2116	Tilecomgm.com	94
PID 2236 wrote to memory of 3436	2236	Tilecomgm.com	95
PID 2236 wrote to memory of 3436	2236	Tilecomgm.com	95
PID 2236 wrote to memory of 3436	2236	Tilecomgm.com	95
PID 3436 wrote to memory of 4840	3436	cmd.exe	96
PID 3436 wrote to memory of 4840	3436	cmd.exe	96
PID 3436 wrote to memory of 4840	3436	cmd.exe	96
PID 2236 wrote to memory of 3208	2236	Tilecomgm.com	98
PID 2236 wrote to memory of 3208	2236	Tilecomgm.com	98
PID 2236 wrote to memory of 3208	2236	Tilecomgm.com	98
PID 3208 wrote to memory of 3164	3208	Tilecomgm.com	99
PID 3208 wrote to memory of 3164	3208	Tilecomgm.com	99
PID 3208 wrote to memory of 3164	3208	Tilecomgm.com	99
PID 3164 wrote to memory of 3312	3164	cmd.exe	100
PID 3164 wrote to memory of 3312	3164	cmd.exe	100
PID 3164 wrote to memory of 3312	3164	cmd.exe	100
PID 3208 wrote to memory of 5036	3208	Tilecomgm.com	102
PID 3208 wrote to memory of 5036	3208	Tilecomgm.com	102
PID 3208 wrote to memory of 5036	3208	Tilecomgm.com	102
PID 5036 wrote to memory of 2620	5036	Tilecomgm.com	103
PID 5036 wrote to memory of 2620	5036	Tilecomgm.com	103
PID 5036 wrote to memory of 2620	5036	Tilecomgm.com	103
PID 2620 wrote to memory of 2464	2620	cmd.exe	104
PID 2620 wrote to memory of 2464	2620	cmd.exe	104
PID 2620 wrote to memory of 2464	2620	cmd.exe	104
PID 5036 wrote to memory of 2864	5036	Tilecomgm.com	105
PID 5036 wrote to memory of 2864	5036	Tilecomgm.com	105
PID 5036 wrote to memory of 2864	5036	Tilecomgm.com	105
PID 2864 wrote to memory of 2184	2864	Tilecomgm.com	106
PID 2864 wrote to memory of 2184	2864	Tilecomgm.com	106
PID 2864 wrote to memory of 2184	2864	Tilecomgm.com	106
PID 2184 wrote to memory of 5032	2184	cmd.exe	107
PID 2184 wrote to memory of 5032	2184	cmd.exe	107
PID 2184 wrote to memory of 5032	2184	cmd.exe	107
PID 2864 wrote to memory of 880	2864	Tilecomgm.com	108
PID 2864 wrote to memory of 880	2864	Tilecomgm.com	108
PID 2864 wrote to memory of 880	2864	Tilecomgm.com	108
PID 880 wrote to memory of 536	880	Tilecomgm.com	109
PID 880 wrote to memory of 536	880	Tilecomgm.com	109
PID 880 wrote to memory of 536	880	Tilecomgm.com	109
PID 536 wrote to memory of 1852	536	cmd.exe	110
PID 536 wrote to memory of 1852	536	cmd.exe	110
PID 536 wrote to memory of 1852	536	cmd.exe	110
PID 880 wrote to memory of 4964	880	Tilecomgm.com	111
PID 880 wrote to memory of 4964	880	Tilecomgm.com	111
PID 880 wrote to memory of 4964	880	Tilecomgm.com	111
PID 4964 wrote to memory of 3476	4964	Tilecomgm.com	112

C:\Users\Admin\AppData\Local\Temp\4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe
"C:\Users\Admin\AppData\Local\Temp\4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\AcD.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:3572
- C:\Windows\SysWOW64\Tilecomgm.com
  C:\Windows\system32\Tilecomgm.com 1072 "C:\Users\Admin\AppData\Local\Temp\4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339N.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\AcD.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:936
- - C:\Windows\SysWOW64\Tilecomgm.com
    C:\Windows\system32\Tilecomgm.com 1208 "C:\Windows\SysWOW64\Tilecomgm.com"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\AcD.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:4840
  - - C:\Windows\SysWOW64\Tilecomgm.com
      C:\Windows\system32\Tilecomgm.com 1184 "C:\Windows\SysWOW64\Tilecomgm.com"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3164
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3312
    - - C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1180 "C:\Windows\SysWOW64\Tilecomgm.com"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2464
      - C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1188 "C:\Windows\SysWOW64\Tilecomgm.com"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:5032
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1192 "C:\Windows\SysWOW64\Tilecomgm.com"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1852
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1200 "C:\Windows\SysWOW64\Tilecomgm.com"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:5112
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1196 "C:\Windows\SysWOW64\Tilecomgm.com"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
683B

MD5
6fe56f6715b4c328bc5b2b35cb51c7e1

SHA1
8f4c2a2e2704c52fd6f01d9c58e4c7d843d69cc3

SHA256
0686dfa785bc9687be1a2bb42ef6c2e805a03f62b4af6c83bac7031e515189be

SHA512
8a19ba3f6e5678e92a6fd92a84f077e851a53a71a02622d87d5213a79f40540c7bbda17219f9349387e94edc75eb12fd2cb93e3b0abbcf9a85fc7d5e8bf3be0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
851B

MD5
a13ff758fc4326eaa44582bc9700aead

SHA1
a4927b4a3b84526c5c42a077ade4652ab308f83f

SHA256
c0915178e63bf84c54e9c942b5cc80327c24d84125042767d7e1e2ef3e004588

SHA512
86c336086a1d0ca689e133df8e3c3ec83eeef86649dbf8b9d367c3e543358ad54f69d1a20d56c56200e294f22b2741186db0f359051159b4e670d3e9b5861842

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
576B

MD5
8a0897226da780b90c11da0756b361f1

SHA1
67f813e8733ad75a2147c59cca102a60274daeab

SHA256
115ff7b8bbe33e1325a2b03fb279281b79b2b9c4c0d6147c049c99da39867bee

SHA512
55e0e0791fb8e76fb67511ef2bfe1bdb934c857a5a555f9c72dd063250c18b17c57ff9f220c0d3cdd219828d87f5c08bfe5e198476c9d38119c4cfb099b99642

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
784B

MD5
5a466127fedf6dbcd99adc917bd74581

SHA1
a2e60b101c8789b59360d95a64ec07d0723c4d38

SHA256
8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84

SHA512
695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
6bf876cd9994f0d41be4eca36d22c42a

SHA1
50cda4b940e6ba730ce59000cfc59e6c4d7fdc79

SHA256
ff39ffe6e43e9b293c5be6aa85345e868a27215293e750c00e1e0ba676deeb2a

SHA512
605e2920cd230b6c617a2d4153f23144954cd4bae0f66b857e1b334cd66258fbc5ba049c1ab6ab83c30fd54c87235a115ec7bbfd17d6792a4bbbae4c6700e106

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
449B

MD5
c6b0028a6f5508ef564d624eda0e72bc

SHA1
18901c9856a9af672c2e27383c15d2da41f27b6b

SHA256
b41f477ecd348b1c3e12ef410d67b712627ed0696769c2c8cc2f087d02121d06

SHA512
5d5f6fb437767096562f2ab9aac2cb75611afcc090b0a65ea63dfbadb3c4a73a3d45bbe139e43a7beea889370c76ac2eb2aa0fdffa92b69cfe47dd1ffbf10a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
f1cbbc2ce0d93c45a92edcc86780e9f0

SHA1
d893306caae2584cdeba4c80c3bfe18548fa227a

SHA256
6646122747280612f7cb0e88c16544e472aae7c20217b711bbee8f10562e49c7

SHA512
b4ba834ab846d1dc9bbeca52e54705cdbf010687a5c1c54a82fddc15c64025528ef874213a59d1be5fb7ada7abd0862235a0c924f10819fbbfb36bd2ba29adf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
5f6aefafda312b288b7d555c1fc36dc9

SHA1
f25e2fdea9dd714d0fae68af71cace7bb49302ce

SHA256
60f6d3cbf831857bf18e46a43ff403a03e2035d9430a72d768ea9cec1947917a

SHA512
97f0250ba79b008d7632a2f32a7b851d9ca87f116b2854d5343c120511cfd55551a1f3eb3e0959602656b39b3f86003a0f9d04243ceb8b73d28eb9bb9449a6de

Download Submit
C:\Windows\SysWOW64\Tilecomgm.com

Filesize
220KB

MD5
e700d0d7c9bcc8baf58e33747b0df4b0

SHA1
7e411f52a65e4cd92599ff86750b55a57e285724

SHA256
4360a2092acd1ac59d8ef810bf7f487547732fdbfb2e82f64b35411b4ab45339

SHA512
6c954ef6c161cfd189bee3c50d04b723c420b2970aa4939e56201d73f53049a17d3644799b575c00ae0799026422f8afbf521856ffcd305d5364034164dd10bc

Download Submit
\??\c:\AcD.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/880-987-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/880-762-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/880-874-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2116-417-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2116-191-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2116-176-0x0000000000700000-0x0000000000730000-memory.dmp

Filesize
192KB

Download
memory/2116-184-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/2116-183-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2116-416-0x0000000000700000-0x0000000000730000-memory.dmp

Filesize
192KB

Download
memory/2116-192-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2116-190-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2116-303-0x0000000000700000-0x0000000000730000-memory.dmp

Filesize
192KB

Download
memory/2116-302-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2116-189-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2116-180-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2116-181-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2116-182-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2116-186-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2116-187-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2116-188-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2236-305-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2236-531-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2236-418-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2864-648-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2864-760-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2864-873-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3208-645-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3208-420-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3208-532-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3256-16-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3256-12-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3256-156-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/3256-166-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/3256-172-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/3256-147-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/3256-171-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3256-177-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3256-5-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3256-170-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/3256-169-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/3256-168-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/3256-167-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/3256-164-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/3256-162-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/3256-161-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/3256-160-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/3256-165-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/3256-163-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/3256-155-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/3256-154-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/3256-153-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/3256-152-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/3256-151-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/3256-150-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3256-148-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/3256-178-0x0000000000660000-0x0000000000690000-memory.dmp

Filesize
192KB

Download
memory/3256-6-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3256-7-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/3256-8-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3256-9-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3256-10-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3256-11-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/3256-149-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/3256-13-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/3256-14-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3256-15-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3256-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3256-17-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3256-18-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3256-301-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3256-19-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3256-20-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3256-21-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3256-22-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3256-23-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3256-24-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3256-25-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/3256-26-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3256-27-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3256-28-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3256-1-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3256-29-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3256-2-0x0000000000660000-0x0000000000690000-memory.dmp

Filesize
192KB

Download
memory/3256-30-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3256-31-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3256-3-0x00000000006A0000-0x00000000006A4000-memory.dmp

Filesize
16KB

Download
memory/3256-32-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3256-33-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3256-36-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3256-35-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3256-37-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3256-34-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4964-876-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/5036-759-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/5036-646-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/5036-534-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads