c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81b

Analysis

max time kernel
118s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
Size 90KB
Sample240925-g9ht2atalg
SHA256 c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81b
MD5 f73726c99d857eded08ef51f4a58c4b0
SHA1 9d5b7911326b842d05945e1e8dff5f215981e265
SHA512 4430c0ea03520540d6ada00b19fb97d6fae9d8b254a29a3b9e63b36740b14ccf87a94a149f8f6bd2aac9b72e6c6681cc01b1bab13f9d141a09df155788ceda84
SSDEEP 768:5vw9816thKQLroK4/wQkNrfrunMxVFA3bA:lEG/0oKlbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{965015B4-97CB-4234-A9A0-6445DA32B02B}\stubpath = "C:\\Windows\\{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe"	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F832CE96-A134-49c9-ACEE-E603146356E6}\stubpath = "C:\\Windows\\{F832CE96-A134-49c9-ACEE-E603146356E6}.exe"	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17C4AF5E-CE75-4bd1-81C6-08189344665A}\stubpath = "C:\\Windows\\{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe"	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD840847-6054-4855-B349-5395D3C4C03D}\stubpath = "C:\\Windows\\{AD840847-6054-4855-B349-5395D3C4C03D}.exe"	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{105019B8-DFE4-4542-863E-23F83520CC63}	{AD840847-6054-4855-B349-5395D3C4C03D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E259FC1A-F5CC-4893-A705-173648128C87}\stubpath = "C:\\Windows\\{E259FC1A-F5CC-4893-A705-173648128C87}.exe"	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{571046F4-E5A3-49a4-8803-C3263DB5C58B}\stubpath = "C:\\Windows\\{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe"	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{965015B4-97CB-4234-A9A0-6445DA32B02B}	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F832CE96-A134-49c9-ACEE-E603146356E6}	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17C4AF5E-CE75-4bd1-81C6-08189344665A}	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD840847-6054-4855-B349-5395D3C4C03D}	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E259FC1A-F5CC-4893-A705-173648128C87}	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{571046F4-E5A3-49a4-8803-C3263DB5C58B}	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}\stubpath = "C:\\Windows\\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe"	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}\stubpath = "C:\\Windows\\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe"	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{105019B8-DFE4-4542-863E-23F83520CC63}\stubpath = "C:\\Windows\\{105019B8-DFE4-4542-863E-23F83520CC63}.exe"	{AD840847-6054-4855-B349-5395D3C4C03D}.exe

Executes dropped EXE 9 IoCs

pid	Process
2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe
4532	{105019B8-DFE4-4542-863E-23F83520CC63}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
File created	C:\Windows\{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
File created	C:\Windows\{AD840847-6054-4855-B349-5395D3C4C03D}.exe	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
File created	C:\Windows\{105019B8-DFE4-4542-863E-23F83520CC63}.exe	{AD840847-6054-4855-B349-5395D3C4C03D}.exe
File created	C:\Windows\{E259FC1A-F5CC-4893-A705-173648128C87}.exe	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
File created	C:\Windows\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
File created	C:\Windows\{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
File created	C:\Windows\{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
File created	C:\Windows\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{105019B8-DFE4-4542-863E-23F83520CC63}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AD840847-6054-4855-B349-5395D3C4C03D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
Token: SeIncBasePriorityPrivilege	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe
Token: SeIncBasePriorityPrivilege	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
Token: SeIncBasePriorityPrivilege	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
Token: SeIncBasePriorityPrivilege	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
Token: SeIncBasePriorityPrivilege	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
Token: SeIncBasePriorityPrivilege	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
Token: SeIncBasePriorityPrivilege	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
Token: SeIncBasePriorityPrivilege	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2268	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	89
PID 1348 wrote to memory of 2268	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	89
PID 1348 wrote to memory of 2268	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	89
PID 1348 wrote to memory of 5060	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	90
PID 1348 wrote to memory of 5060	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	90
PID 1348 wrote to memory of 5060	1348	c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe	90
PID 2268 wrote to memory of 3696	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	91
PID 2268 wrote to memory of 3696	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	91
PID 2268 wrote to memory of 3696	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	91
PID 2268 wrote to memory of 4440	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	92
PID 2268 wrote to memory of 4440	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	92
PID 2268 wrote to memory of 4440	2268	{E259FC1A-F5CC-4893-A705-173648128C87}.exe	92
PID 3696 wrote to memory of 4860	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	95
PID 3696 wrote to memory of 4860	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	95
PID 3696 wrote to memory of 4860	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	95
PID 3696 wrote to memory of 5104	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	96
PID 3696 wrote to memory of 5104	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	96
PID 3696 wrote to memory of 5104	3696	{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe	96
PID 4860 wrote to memory of 2568	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	97
PID 4860 wrote to memory of 2568	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	97
PID 4860 wrote to memory of 2568	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	97
PID 4860 wrote to memory of 8	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	98
PID 4860 wrote to memory of 8	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	98
PID 4860 wrote to memory of 8	4860	{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe	98
PID 2568 wrote to memory of 5032	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	99
PID 2568 wrote to memory of 5032	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	99
PID 2568 wrote to memory of 5032	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	99
PID 2568 wrote to memory of 3100	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	100
PID 2568 wrote to memory of 3100	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	100
PID 2568 wrote to memory of 3100	2568	{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe	100
PID 5032 wrote to memory of 4192	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	101
PID 5032 wrote to memory of 4192	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	101
PID 5032 wrote to memory of 4192	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	101
PID 5032 wrote to memory of 1204	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	102
PID 5032 wrote to memory of 1204	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	102
PID 5032 wrote to memory of 1204	5032	{F832CE96-A134-49c9-ACEE-E603146356E6}.exe	102
PID 4192 wrote to memory of 956	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	103
PID 4192 wrote to memory of 956	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	103
PID 4192 wrote to memory of 956	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	103
PID 4192 wrote to memory of 412	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	104
PID 4192 wrote to memory of 412	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	104
PID 4192 wrote to memory of 412	4192	{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe	104
PID 956 wrote to memory of 4620	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	105
PID 956 wrote to memory of 4620	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	105
PID 956 wrote to memory of 4620	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	105
PID 956 wrote to memory of 2020	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	106
PID 956 wrote to memory of 2020	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	106
PID 956 wrote to memory of 2020	956	{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe	106
PID 4620 wrote to memory of 4532	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	107
PID 4620 wrote to memory of 4532	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	107
PID 4620 wrote to memory of 4532	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	107
PID 4620 wrote to memory of 2468	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	108
PID 4620 wrote to memory of 2468	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	108
PID 4620 wrote to memory of 2468	4620	{AD840847-6054-4855-B349-5395D3C4C03D}.exe	108

C:\Users\Admin\AppData\Local\Temp\c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe
"C:\Users\Admin\AppData\Local\Temp\c89f1306113f6fe529ab890c2e0c1c7472534ec559da1a317de4cc77a96aa81bN.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\{E259FC1A-F5CC-4893-A705-173648128C87}.exe
  C:\Windows\{E259FC1A-F5CC-4893-A705-173648128C87}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
    C:\Windows\{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
      C:\Windows\{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
        
        C:\Windows\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Windows\{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
        
        C:\Windows\{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
        
        C:\Windows\{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
        
        C:\Windows\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\{AD840847-6054-4855-B349-5395D3C4C03D}.exe
        
        C:\Windows\{AD840847-6054-4855-B349-5395D3C4C03D}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\{105019B8-DFE4-4542-863E-23F83520CC63}.exe
        
        C:\Windows\{105019B8-DFE4-4542-863E-23F83520CC63}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD840~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12C89~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{17C4A~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F832C~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D1F1~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96501~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{57104~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E259F~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C89F13~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{105019B8-DFE4-4542-863E-23F83520CC63}.exe

Path C:\Windows\{105019B8-DFE4-4542-863E-23F83520CC63}.exe
Size 90KB
SHA256 0839b27f6ce7e4706d5f988afb9322ef9e3bd5569b79085ce4bcd20931db7397
MD5 06e3bd0e7a4645147763b498f27d1fd8
SHA1 09cfd316bc5c22cb2d4496b3ed7004f801f33a74
SHA512 e8fb58d8b4558a29f54ecdd32010276121f92caaf8f1f5aec48cd7b512b1c5c6b2e29ac7117484b63370544d161db7387f901bd6b8c10a9ab598271b88d782d7
SSDEEP 768:5vw9816thKQLroa4/wQkNrfrunMxVFA3bA:lEG/0oalbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe

Path C:\Windows\{12C89EB6-4B71-4662-AFF2-21A0EED259C8}.exe
Size 90KB
SHA256 8545ccb426a23e0cb64962b6860b3aeea8f76266969c6b4aad43997a47a10bf0
MD5 3c2dd94a27c8ef29c620782bcc3acab0
SHA1 dbd805eb5bf24b7033d849f1d8c5ebff32c45b0b
SHA512 696df04b3ddc2cb6406f3fda43ab95f813d4c4ef8347b09c898dae8ff03b11fca94cf268cca6589c28b68dab5c5f1ab1a276493d2b9c304dc4ee3552b092d553
SSDEEP 768:5vw9816thKQLro44/wQkNrfrunMxVFA3bA:lEG/0o4lbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe

Path C:\Windows\{17C4AF5E-CE75-4bd1-81C6-08189344665A}.exe
Size 90KB
SHA256 a286c342a4661520cd3e07ffe160d42ffab57c537eacfdf55d6c1a2e5023ee96
MD5 0a5dcb6e2dc60c5d4f065bdda7fc071f
SHA1 6a86a5ebaea2f54419b88d42611ed437dd27fbe4
SHA512 475d289ae27456ed69c56810104442b0a3e47dcf6d9b5e09c9d82119a063efd2548c62d2b0b73350e113e017f3f641db7ef8fd850f223a52868df61e2163c256
SSDEEP 768:5vw9816thKQLrog4/wQkNrfrunMxVFA3bA:lEG/0oglbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe

Path C:\Windows\{571046F4-E5A3-49a4-8803-C3263DB5C58B}.exe
Size 90KB
SHA256 34220f1e3d15ad3c3def2b9d05186f4b41f9bde14f1587fd472626896dabcc97
MD5 e2303eb2482c4b17e3a0b09ceab78683
SHA1 fc63b9b9394d704ab6e0fa7773b0056a1e4286a6
SHA512 a75c95f2ad374f56046f15d4dfe19512d33981c58428aec00c9247b21a3763012f64d4695527a74f66ca3e738b0ec691cab13cc3d8d56b3d1358d4e4a02d9158
SSDEEP 768:5vw9816thKQLroK4/wQkNrfrunMxVFA3bA:lEG/0oKlbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe

Path C:\Windows\{5D1F1511-0014-41df-BDDF-6FA8B2C49E42}.exe
Size 90KB
SHA256 f9550aaa2885fb0a3e14209c75d697d7f5a636e1ffca7b5c937837e611c91297
MD5 a2256bce8b3f1eb343fb6175a555646a
SHA1 a8ad04968c2a9aad7a232b3853cbf1162048ddc8
SHA512 914891a4a513372a82fa65b975a8c843698940f9c5dbf57806a12a1b8dd69e84734cc57d1de4e456f2af1a07bf28478220bc54a53513d4036a13185c3fe0afad
SSDEEP 768:5vw9816thKQLros4/wQkNrfrunMxVFA3bA:lEG/0oslbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe

Path C:\Windows\{965015B4-97CB-4234-A9A0-6445DA32B02B}.exe
Size 90KB
SHA256 d3d2aa0f45c422f21468a607142dfe7c63926b24c3615a62033311cc0b3bfb53
MD5 1b70a348311450ac8318ab1cc81e70f3
SHA1 b6ee450fec4c9a3b7b34c6ec5cb5d09058b82d45
SHA512 33eb2f1499c4f382c026bec6716e6ab7924da6617502f9a6a9d136da9e95ce2d9a75590bf221c0da0f39cdd5f69b746719f9586da2ceb5dbedd9a4821843df53
SSDEEP 768:5vw9816thKQLrou4/wQkNrfrunMxVFA3bA:lEG/0oulbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AD840847-6054-4855-B349-5395D3C4C03D}.exe

Path C:\Windows\{AD840847-6054-4855-B349-5395D3C4C03D}.exe
Size 90KB
SHA256 5ea300719b47101e0e829b781c7c34d0012907e250583a68f63ca951acd108a8
MD5 d88818cf7710bd12cc99459c46bd921a
SHA1 aaf1d081e624b99630dcec79c5abcc000cd06585
SHA512 e5badc3e9471e86ab2d126aa114de6c52fa50239020f65ba8c8bb8fd857fed61c9dc7d6a768c764739a34034f72fb6ad203f66221b0ae2d5bf8ae35e0c1fc001
SSDEEP 768:5vw9816thKQLroH4/wQkNrfrunMxVFA3bA:lEG/0oHlbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E259FC1A-F5CC-4893-A705-173648128C87}.exe

Path C:\Windows\{E259FC1A-F5CC-4893-A705-173648128C87}.exe
Size 90KB
SHA256 6dee81a5ecbf953899b693013c7a59cf1dae90182c59b0a380d6d5e3bb0ef0f3
MD5 14608be38754c03347c52c51c0732432
SHA1 6fcc882337b3eb7a1bdbec6758f77fae071a6adf
SHA512 2d8cfa8e0e15d7bc0407ccdd42979bee47c70d54b5c9f3420edd144afb2a0b0b3741daf893d2d6f5bea0486e700f25ac002017ed8f04246417aa6f4fa60a5acc
SSDEEP 768:5vw9816thKQLro44/wQkNrfrunMxVFA3bA:lEG/0o4lbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F832CE96-A134-49c9-ACEE-E603146356E6}.exe

Path C:\Windows\{F832CE96-A134-49c9-ACEE-E603146356E6}.exe
Size 90KB
SHA256 1b46f743e18e70bd0964eab1b64453667cb348c72e8b674dd558cac606f002f7
MD5 f449317685aa33a64d678f1ee9d364c4
SHA1 1934d99d81349abfab5c813fca503dd682671b50
SHA512 b0f68b1920a698e06910db70807f95b0ffb0997337fdb228a32cd9a72e8830975a95a69495136275a56a81c9273fd8abc8137c08bea311dce0519977edebf406
SSDEEP 768:5vw9816thKQLroI4/wQkNrfrunMxVFA3bA:lEG/0oIlbunMxVS3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-41-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/956-45-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/1348-1-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/1348-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/1348-7-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2268-12-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2268-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2268-8-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2568-25-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2568-30-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3696-17-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4192-35-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4192-40-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4532-53-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4620-47-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4620-52-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4860-19-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4860-23-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/5032-34-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads