175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9d

Analysis

max time kernel
145s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
Size

349KB
MD5

dca4c17809ab47673398bfd94be5afb0
SHA1

84077482e0ea434b2f9007a5c206f09352aec9ff
SHA256

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9d
SHA512

244af54798400aa8d845afb71f14d55e9e164b88edd689a2e8cb67892fe98057d99bbb03477991613d9a4c6cf7d1404e881159f7e643ce9cc6102089354f5e79
SSDEEP

6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIQ:FB1Q6rpr7MrswfLjGwW5xFdRyJpj

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2364	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

REG.exeattrib.exeping.exeping.exeping.exeping.exeREG.exeREG.exeREG.exeping.exeping.exeREG.exeping.exeping.exeping.exeping.exeREG.exeREG.exeping.exeping.exeREG.exeREG.exeREG.exeREG.exe175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exeping.exeping.exeREG.exeREG.exeREG.exeREG.exeping.exeping.exeping.exeREG.exeREG.exeping.exeping.exeping.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	Process
2916	ping.exe
1940	ping.exe
4176	ping.exe
2516	ping.exe
448	ping.exe
1964	ping.exe
4284	ping.exe
4356	ping.exe
3988	ping.exe
2084	ping.exe
5072	ping.exe
1688	ping.exe
2020	ping.exe
1264	ping.exe
1944	ping.exe
4372	ping.exe
2192	ping.exe
3928	ping.exe
2580	ping.exe
2124	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	Process
448	ping.exe
2516	ping.exe
4284	ping.exe
2084	ping.exe
2580	ping.exe
1964	ping.exe
1944	ping.exe
1940	ping.exe
4176	ping.exe
1688	ping.exe
2124	ping.exe
4372	ping.exe
3928	ping.exe
2192	ping.exe
3988	ping.exe
5072	ping.exe
2020	ping.exe
2916	ping.exe
1264	ping.exe
4356	ping.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

pid	Process
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

description	pid	Process
Token: SeDebugPrivilege	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe

description	pid	Process	procid_target
PID 3888 wrote to memory of 5072	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	86
PID 3888 wrote to memory of 5072	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	86
PID 3888 wrote to memory of 5072	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	86
PID 3888 wrote to memory of 448	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	88
PID 3888 wrote to memory of 448	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	88
PID 3888 wrote to memory of 448	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	88
PID 3888 wrote to memory of 1964	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	90
PID 3888 wrote to memory of 1964	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	90
PID 3888 wrote to memory of 1964	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	90
PID 3888 wrote to memory of 2124	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	92
PID 3888 wrote to memory of 2124	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	92
PID 3888 wrote to memory of 2124	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	92
PID 3888 wrote to memory of 2020	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	94
PID 3888 wrote to memory of 2020	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	94
PID 3888 wrote to memory of 2020	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	94
PID 3888 wrote to memory of 2516	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	96
PID 3888 wrote to memory of 2516	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	96
PID 3888 wrote to memory of 2516	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	96
PID 3888 wrote to memory of 2916	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	98
PID 3888 wrote to memory of 2916	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	98
PID 3888 wrote to memory of 2916	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	98
PID 3888 wrote to memory of 4284	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	100
PID 3888 wrote to memory of 4284	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	100
PID 3888 wrote to memory of 4284	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	100
PID 3888 wrote to memory of 1264	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	104
PID 3888 wrote to memory of 1264	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	104
PID 3888 wrote to memory of 1264	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	104
PID 3888 wrote to memory of 1944	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	106
PID 3888 wrote to memory of 1944	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	106
PID 3888 wrote to memory of 1944	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	106
PID 3888 wrote to memory of 2272	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	108
PID 3888 wrote to memory of 2272	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	108
PID 3888 wrote to memory of 2272	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	108
PID 3888 wrote to memory of 2364	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	109
PID 3888 wrote to memory of 2364	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	109
PID 3888 wrote to memory of 2364	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	109
PID 3888 wrote to memory of 4356	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	110
PID 3888 wrote to memory of 4356	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	110
PID 3888 wrote to memory of 4356	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	110
PID 3888 wrote to memory of 4372	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	114
PID 3888 wrote to memory of 4372	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	114
PID 3888 wrote to memory of 4372	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	114
PID 3888 wrote to memory of 2192	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	116
PID 3888 wrote to memory of 2192	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	116
PID 3888 wrote to memory of 2192	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	116
PID 3888 wrote to memory of 3988	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	118
PID 3888 wrote to memory of 3988	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	118
PID 3888 wrote to memory of 3988	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	118
PID 3888 wrote to memory of 3928	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	120
PID 3888 wrote to memory of 3928	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	120
PID 3888 wrote to memory of 3928	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	120
PID 3888 wrote to memory of 1940	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	122
PID 3888 wrote to memory of 1940	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	122
PID 3888 wrote to memory of 1940	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	122
PID 3888 wrote to memory of 4176	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	124
PID 3888 wrote to memory of 4176	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	124
PID 3888 wrote to memory of 4176	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	124
PID 3888 wrote to memory of 2084	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	126
PID 3888 wrote to memory of 2084	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	126
PID 3888 wrote to memory of 2084	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	126
PID 3888 wrote to memory of 1688	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	128
PID 3888 wrote to memory of 1688	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	128
PID 3888 wrote to memory of 1688	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	128
PID 3888 wrote to memory of 2580	3888	175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe	130

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
2364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
"C:\Users\Admin\AppData\Local\Temp\175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5072
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:448
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1964
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2124
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2020
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2516
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2916
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4284
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1264
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1944
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\175b82e044e4cd32d293acbad6b9772c7d9002c64936b5ca4af8eca63ea0cd9dN.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2364
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4356
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4372
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2192
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3988
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3928
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1940
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4176
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2084
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1688
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2580
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2600
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3728
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:220
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1432
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4888
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3600
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe

Filesize
349KB

MD5
5b4b47455e35a64cf40f5ae65b0457f0

SHA1
569b92cb11c9a2a84bdf3843ab56e18d17b3187d

SHA256
32f8ac4acfa3f1e8171df7779d2382f30bfb14f8e8378d5680690cda70e8e25e

SHA512
727cb8d36cb060210a4cd63c5e3e2a7f37f7061991c5feb69c9a31c2a269ba5a3661f93a6297f66a2b0fbca68a4eb4bfc9bfff3214636a97b36776dbc238a543

Download Submit
memory/3888-0-0x00000000754C2000-0x00000000754C3000-memory.dmp

Filesize
4KB

Download
memory/3888-1-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download
memory/3888-2-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download
memory/3888-4-0x00000000754C2000-0x00000000754C3000-memory.dmp

Filesize
4KB

Download
memory/3888-5-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download