4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40

Analysis

max time kernel
115s
max time network
35s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
Size

178KB
MD5

a012533b4e4ffe2ec1fba8af4d64f7d0
SHA1

6addd503fa50ab9b551ff26cfd44f65d0348e898
SHA256

4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40
SHA512

f588e81bf477c001995d44d7d17eedca3a7392eb43072679e06b1440f8c9cb9dd1ecf597e536ccf2975fcf9f3d7c481306b3a018194815e6f87bdfd211604301
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28Z

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1928	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
672	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
684	ping.exe
2488	ping.exe
2928	ping.exe
2400	ping.exe
1676	ping.exe
2136	ping.exe
2000	ping.exe
2376	ping.exe
2808	ping.exe
1708	ping.exe
1800	ping.exe
1916	ping.exe
1284	ping.exe
1560	ping.exe
1620	ping.exe
2544	ping.exe
2176	ping.exe
3048	ping.exe
2520	ping.exe
1876	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
1916	ping.exe
2400	ping.exe
1676	ping.exe
3048	ping.exe
2808	ping.exe
2488	ping.exe
1560	ping.exe
2376	ping.exe
2520	ping.exe
2928	ping.exe
1708	ping.exe
2544	ping.exe
2176	ping.exe
1876	ping.exe
1284	ping.exe
2136	ping.exe
684	ping.exe
1620	ping.exe
1800	ping.exe
2000	ping.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2000	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	28
PID 2868 wrote to memory of 2000	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	28
PID 2868 wrote to memory of 2000	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	28
PID 2868 wrote to memory of 2000	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	28
PID 2868 wrote to memory of 2376	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2868 wrote to memory of 2376	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2868 wrote to memory of 2376	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2868 wrote to memory of 2376	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2868 wrote to memory of 2176	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2868 wrote to memory of 2176	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2868 wrote to memory of 2176	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2868 wrote to memory of 2176	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2868 wrote to memory of 3048	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	36
PID 2868 wrote to memory of 3048	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	36
PID 2868 wrote to memory of 3048	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	36
PID 2868 wrote to memory of 3048	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	36
PID 2868 wrote to memory of 2808	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	38
PID 2868 wrote to memory of 2808	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	38
PID 2868 wrote to memory of 2808	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	38
PID 2868 wrote to memory of 2808	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	38
PID 2868 wrote to memory of 2520	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	40
PID 2868 wrote to memory of 2520	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	40
PID 2868 wrote to memory of 2520	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	40
PID 2868 wrote to memory of 2520	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	40
PID 2868 wrote to memory of 2488	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	42
PID 2868 wrote to memory of 2488	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	42
PID 2868 wrote to memory of 2488	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	42
PID 2868 wrote to memory of 2488	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	42
PID 2868 wrote to memory of 2928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	44
PID 2868 wrote to memory of 2928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	44
PID 2868 wrote to memory of 2928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	44
PID 2868 wrote to memory of 2928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	44
PID 2868 wrote to memory of 1876	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	46
PID 2868 wrote to memory of 1876	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	46
PID 2868 wrote to memory of 1876	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	46
PID 2868 wrote to memory of 1876	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	46
PID 2868 wrote to memory of 1916	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	48
PID 2868 wrote to memory of 1916	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	48
PID 2868 wrote to memory of 1916	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	48
PID 2868 wrote to memory of 1916	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	48
PID 2868 wrote to memory of 1928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	50
PID 2868 wrote to memory of 1928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	50
PID 2868 wrote to memory of 1928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	50
PID 2868 wrote to memory of 1928	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	50
PID 2868 wrote to memory of 2020	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	52
PID 2868 wrote to memory of 2020	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	52
PID 2868 wrote to memory of 2020	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	52
PID 2868 wrote to memory of 2020	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	52
PID 2868 wrote to memory of 1708	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2868 wrote to memory of 1708	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2868 wrote to memory of 1708	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2868 wrote to memory of 1708	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2868 wrote to memory of 2400	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	56
PID 2868 wrote to memory of 2400	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	56
PID 2868 wrote to memory of 2400	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	56
PID 2868 wrote to memory of 2400	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	56
PID 2868 wrote to memory of 1284	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	58
PID 2868 wrote to memory of 1284	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	58
PID 2868 wrote to memory of 1284	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	58
PID 2868 wrote to memory of 1284	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	58
PID 2868 wrote to memory of 1676	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	60
PID 2868 wrote to memory of 1676	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	60
PID 2868 wrote to memory of 1676	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	60
PID 2868 wrote to memory of 1676	2868	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	60

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
"C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2000
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2376
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2176
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3048
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2808
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2520
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2488
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2928
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1876
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1916
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1928
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1708
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2400
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1284
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1676
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2136
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2544
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:684
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1560
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1620
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
  "C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe"
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:480
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:464
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2196
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IntelCore\IntelCore.exe

Filesize
178KB

MD5
86476f1861abb9d4aa17caf375035bba

SHA1
80876830cd359796f11ed89c4c5332dd80db2ece

SHA256
5cfb9cd7d947c1e15aaed582db83fe0724b21081c5b4bdea4b2600d935eff7e7

SHA512
ea9bde8cd04ed5206de7ac8d01f4fd0d3fa47904ce4e6198294155f63e544fb0587d8ef35853f2ce1d95634414a2e3db48f8a4acddb1177d152aaf4bf5e77a35

Download Submit
\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Filesize
178KB

MD5
a012533b4e4ffe2ec1fba8af4d64f7d0

SHA1
6addd503fa50ab9b551ff26cfd44f65d0348e898

SHA256
4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40

SHA512
f588e81bf477c001995d44d7d17eedca3a7392eb43072679e06b1440f8c9cb9dd1ecf597e536ccf2975fcf9f3d7c481306b3a018194815e6f87bdfd211604301

Download Submit
memory/2868-0-0x0000000074661000-0x0000000074662000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-2-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-3-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download