Analysis
-
max time kernel
118s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe
Resource
win10v2004-20240802-en
General
-
Target
c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe
-
Size
91KB
-
MD5
9ddf8f3a225c91e4843a89cd8c98ee30
-
SHA1
34b36e7ba162bae5982d27d07abb84a3ec176c4f
-
SHA256
c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483
-
SHA512
204840e7e6ec77a0335d7aa7070b8bf735454654250bef008b52c95708e05ed32349e73a869e83952c2afb077e1d1331d056fe372de244eba0087e0c4c6e4b58
-
SSDEEP
768:5vw9816uhKiro84/wQNNrfrunMxVFA3b7t:lEGkmo8lCunMxVS3Ht
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F47C73-BEC4-430c-ABF3-2C116B0BE743}\stubpath = "C:\\Windows\\{72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe" {B45A544E-5750-46eb-A23F-9551CBA95999}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4400486F-2FE9-4c43-B875-28C8725D22AF}\stubpath = "C:\\Windows\\{4400486F-2FE9-4c43-B875-28C8725D22AF}.exe" {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74508B11-718A-4ff0-8055-3DF1EDBC87EF} {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C065BC8-C0CF-4325-A831-6B10550E25EF} {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E48AC4BC-6134-4662-9B7B-CE57214AB27E}\stubpath = "C:\\Windows\\{E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe" {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9602791-5DF9-4735-922A-6F54D455C7A1}\stubpath = "C:\\Windows\\{E9602791-5DF9-4735-922A-6F54D455C7A1}.exe" {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B45A544E-5750-46eb-A23F-9551CBA95999}\stubpath = "C:\\Windows\\{B45A544E-5750-46eb-A23F-9551CBA95999}.exe" c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66655B9C-621B-4878-B9B9-340DAC2B63EE}\stubpath = "C:\\Windows\\{66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe" {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C696E458-447A-47b8-BB25-6BA5CEBDBB80} {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E48AC4BC-6134-4662-9B7B-CE57214AB27E} {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B45A544E-5750-46eb-A23F-9551CBA95999} c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4400486F-2FE9-4c43-B875-28C8725D22AF} {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66655B9C-621B-4878-B9B9-340DAC2B63EE} {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74508B11-718A-4ff0-8055-3DF1EDBC87EF}\stubpath = "C:\\Windows\\{74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe" {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C696E458-447A-47b8-BB25-6BA5CEBDBB80}\stubpath = "C:\\Windows\\{C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe" {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72F47C73-BEC4-430c-ABF3-2C116B0BE743} {B45A544E-5750-46eb-A23F-9551CBA95999}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C065BC8-C0CF-4325-A831-6B10550E25EF}\stubpath = "C:\\Windows\\{2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe" {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9602791-5DF9-4735-922A-6F54D455C7A1} {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe -
Executes dropped EXE 9 IoCs
pid Process 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 1004 {E9602791-5DF9-4735-922A-6F54D455C7A1}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{E9602791-5DF9-4735-922A-6F54D455C7A1}.exe {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe File created C:\Windows\{B45A544E-5750-46eb-A23F-9551CBA95999}.exe c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe File created C:\Windows\{72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe {B45A544E-5750-46eb-A23F-9551CBA95999}.exe File created C:\Windows\{2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe File created C:\Windows\{C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe File created C:\Windows\{E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe File created C:\Windows\{4400486F-2FE9-4c43-B875-28C8725D22AF}.exe {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe File created C:\Windows\{66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe File created C:\Windows\{74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B45A544E-5750-46eb-A23F-9551CBA95999}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E9602791-5DF9-4735-922A-6F54D455C7A1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe Token: SeIncBasePriorityPrivilege 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe Token: SeIncBasePriorityPrivilege 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe Token: SeIncBasePriorityPrivilege 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe Token: SeIncBasePriorityPrivilege 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe Token: SeIncBasePriorityPrivilege 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe Token: SeIncBasePriorityPrivilege 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe Token: SeIncBasePriorityPrivilege 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe Token: SeIncBasePriorityPrivilege 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2196 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 87 PID 2988 wrote to memory of 2196 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 87 PID 2988 wrote to memory of 2196 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 87 PID 2988 wrote to memory of 4148 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 88 PID 2988 wrote to memory of 4148 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 88 PID 2988 wrote to memory of 4148 2988 c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe 88 PID 2196 wrote to memory of 1912 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 91 PID 2196 wrote to memory of 1912 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 91 PID 2196 wrote to memory of 1912 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 91 PID 2196 wrote to memory of 456 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 92 PID 2196 wrote to memory of 456 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 92 PID 2196 wrote to memory of 456 2196 {B45A544E-5750-46eb-A23F-9551CBA95999}.exe 92 PID 1912 wrote to memory of 1820 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 95 PID 1912 wrote to memory of 1820 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 95 PID 1912 wrote to memory of 1820 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 95 PID 1912 wrote to memory of 3780 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 96 PID 1912 wrote to memory of 3780 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 96 PID 1912 wrote to memory of 3780 1912 {72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe 96 PID 1820 wrote to memory of 4080 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 97 PID 1820 wrote to memory of 4080 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 97 PID 1820 wrote to memory of 4080 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 97 PID 1820 wrote to memory of 3480 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 98 PID 1820 wrote to memory of 3480 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 98 PID 1820 wrote to memory of 3480 1820 {4400486F-2FE9-4c43-B875-28C8725D22AF}.exe 98 PID 4080 wrote to memory of 2808 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 99 PID 4080 wrote to memory of 2808 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 99 PID 4080 wrote to memory of 2808 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 99 PID 4080 wrote to memory of 2156 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 100 PID 4080 wrote to memory of 2156 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 100 PID 4080 wrote to memory of 2156 4080 {66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe 100 PID 2808 wrote to memory of 1348 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 101 PID 2808 wrote to memory of 1348 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 101 PID 2808 wrote to memory of 1348 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 101 PID 2808 wrote to memory of 1000 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 102 PID 2808 wrote to memory of 1000 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 102 PID 2808 wrote to memory of 1000 2808 {74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe 102 PID 1348 wrote to memory of 3612 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 103 PID 1348 wrote to memory of 3612 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 103 PID 1348 wrote to memory of 3612 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 103 PID 1348 wrote to memory of 4888 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 104 PID 1348 wrote to memory of 4888 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 104 PID 1348 wrote to memory of 4888 1348 {2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe 104 PID 3612 wrote to memory of 3488 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 105 PID 3612 wrote to memory of 3488 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 105 PID 3612 wrote to memory of 3488 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 105 PID 3612 wrote to memory of 2240 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 106 PID 3612 wrote to memory of 2240 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 106 PID 3612 wrote to memory of 2240 3612 {C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe 106 PID 3488 wrote to memory of 1004 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 107 PID 3488 wrote to memory of 1004 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 107 PID 3488 wrote to memory of 1004 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 107 PID 3488 wrote to memory of 764 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 108 PID 3488 wrote to memory of 764 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 108 PID 3488 wrote to memory of 764 3488 {E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe"C:\Users\Admin\AppData\Local\Temp\c44a311c7ec3ee6fb95de04bbe87916b4e8a556a083d9bf12961c2ec09273483N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\{B45A544E-5750-46eb-A23F-9551CBA95999}.exeC:\Windows\{B45A544E-5750-46eb-A23F-9551CBA95999}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\{72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exeC:\Windows\{72F47C73-BEC4-430c-ABF3-2C116B0BE743}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\{4400486F-2FE9-4c43-B875-28C8725D22AF}.exeC:\Windows\{4400486F-2FE9-4c43-B875-28C8725D22AF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\{66655B9C-621B-4878-B9B9-340DAC2B63EE}.exeC:\Windows\{66655B9C-621B-4878-B9B9-340DAC2B63EE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\{74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exeC:\Windows\{74508B11-718A-4ff0-8055-3DF1EDBC87EF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\{2C065BC8-C0CF-4325-A831-6B10550E25EF}.exeC:\Windows\{2C065BC8-C0CF-4325-A831-6B10550E25EF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\{C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exeC:\Windows\{C696E458-447A-47b8-BB25-6BA5CEBDBB80}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\{E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exeC:\Windows\{E48AC4BC-6134-4662-9B7B-CE57214AB27E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\{E9602791-5DF9-4735-922A-6F54D455C7A1}.exeC:\Windows\{E9602791-5DF9-4735-922A-6F54D455C7A1}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E48AC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C696E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C065~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74508~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66655~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44004~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:3480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72F47~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:3780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B45A5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C44A31~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:4148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5f7f9a9c41e63cde469bc7d4949e495bc
SHA15779a7f1b986c0db36a992c36803b95dc61925f2
SHA256e180d23f62e06598def8eda586ecac74d1e963cf507a6e3db6bf4fc1b812ed9b
SHA51293c4b7cc2d9230e51b4150486b0958d21dc44debe22a4add17ef15257e009713627d987a0161ce6d712ce2111460be270462a9d4c596f74e5502c2b8065a8b63
-
Filesize
91KB
MD5ccdb4cef21d16fea3d59f26d2ef2c165
SHA117ce5feabdbcccabd0ca26fd74f3d22e86b9a666
SHA256655eb51ef008066ec146d6e3cb4d02f69cdfa0d2a3ae7630c0ef156fb647dcf6
SHA5128f023d39b4e80b173e4a2e8325a7c33bad62c277716da25e7e0c9764058bf8a9e9cc0a8e5dcb779f07be382383c5e3e8981b71eda75f8a3a57cb2e0de19c02e3
-
Filesize
91KB
MD503aefaeefe5a06a20441d646371d1734
SHA1fa0cc9f48751097344aaf8ab44333200f15f78e9
SHA25686d0152d42bd2a71b8b463c61e77f7cef1f92f50936b4de54bd5068420aaae80
SHA512127a2156762a253d8e48c903dc8aae9f80bbdc63d92319b64562c03b8ddafe1d1bb07c2bff3085b81125a6286106ceb20ab4ebfce390bb14db6ac5ab42465df8
-
Filesize
91KB
MD5d1be5416e54d31d5ba817ddf6666aa5a
SHA154fb3b1ce893260b8fea7d517b27ac8bc5a94487
SHA256de21436a4d21293207494a6a77fa56c3d4f07bc70d227f8be4deb06f16688579
SHA512f7562ddc9abee899d084b93f64ebad6be1556cb91a3c80c0e1120743d1795ffb038306da06bdd4875a06d308a6a7f3a9b87beabfb60144033883cd22bb54e96e
-
Filesize
91KB
MD582882447b8f3ce739a6614d7f3b4d05d
SHA192164b4557fd493530ee5841542c7cf735089700
SHA2562e63dab68ec41d15baa8ded74248fa5c65ea978d256accc4f131eb6951fd2f65
SHA51243595990fdc7f5bc129d944f31042ea076a0e104313659532afa00282ca0d704d98f81478beb5a3a7e0988b4de97c83267084a5e6ab3c340a762cfc4c9e32cd1
-
Filesize
91KB
MD5a16c27bfbc6e06aa38888130bdb200eb
SHA12d6736ed90ae80a5e13beec97958b7ed666728d3
SHA25657e42dc7b5c8c3a6873418394e7a61e088d2d64203bd3fc942252c48cdba0381
SHA51267949525e9d4cff6cf78e5429eff556f1e7da0bef64ae795ca3a007568c0b9e354e9dab5a217daffff9144f98514479a12e331c92aafc0b17fd9bcb7a7c6e929
-
Filesize
91KB
MD516df02c5b90ec3704fb57601aa3026dd
SHA1bc9ff18039fa693d349aa85fbafbbc2a6e3f6fa0
SHA256f0c61587f6929b9b5bab838c28c3b7cc560d0befcca73796c9283695b74b6553
SHA51260e4700884ef18e6bcb8c4fc74ec2f7d1e19147a585189075bb7370d9bb5c24d1810054a067f58a86f480f37d3f5102b89d600b68b9121dc6e3f2e6524cc2df7
-
Filesize
91KB
MD5a5d350c62354ee8cbce647a4afb13ef5
SHA1e96c033a89dbcb4f5639b0762b611bbd6e187524
SHA2564964e433f090ffe1216c571d53b6ee1aa7dcc8fdcb61687ccac804429aa3f1bc
SHA512a8be0e9f0c2da5a7e2bcf333fc970826c6a8823b8df09f5b64d0744c1e1e31f4ae113c5cacee6cea028387f14f07703fab633462d20093149618c4ad43165dc7
-
Filesize
91KB
MD5daf1f3ba59b18d6f2e86b520d033ccc9
SHA1fc4e053e55debbb12939e81516bb647b3665e612
SHA256aca171c94d9bd00f4852814f09e96e06e7fec5d87e17868600bbe96c0cf87883
SHA512aac14ea3c586d827f2672af46a3f4d77451480ff318d90b6479609d82bd21646d8bfdab9514b4cf2101d9de2c11c845ac852587bca21a97a1044dcfc333745f4