540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9

Analysis

max time kernel
118s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
Size

178KB
MD5

fdd19703be4eef41ca88975b29887460
SHA1

ee92d74428a9b60aab301ecbe84247a4fa3987f6
SHA256

540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9
SHA512

f91c4a2d09622ff0b26c7c8e1bb0e3316b407978a6c4f00fe9f828239d8232fee6010f67aa386b67f394528bcb71043d9da04e7659b0bce8886973051c15c92e
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28/

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3856	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1120	ping.exe
4188	ping.exe
3776	ping.exe
392	ping.exe
2068	ping.exe
4456	ping.exe
3292	ping.exe
1692	ping.exe
2164	ping.exe
2184	ping.exe
3676	ping.exe
2108	ping.exe
912	ping.exe
4752	ping.exe
60	ping.exe
2572	ping.exe
2880	ping.exe
2340	ping.exe
3940	ping.exe
3156	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
2068	ping.exe
3292	ping.exe
912	ping.exe
3776	ping.exe
1692	ping.exe
3940	ping.exe
2184	ping.exe
2880	ping.exe
3676	ping.exe
2340	ping.exe
3156	ping.exe
2164	ping.exe
4188	ping.exe
60	ping.exe
2572	ping.exe
392	ping.exe
2108	ping.exe
1120	ping.exe
4456	ping.exe
4752	ping.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1120	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	87
PID 5068 wrote to memory of 1120	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	87
PID 5068 wrote to memory of 1120	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	87
PID 5068 wrote to memory of 4456	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	93
PID 5068 wrote to memory of 4456	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	93
PID 5068 wrote to memory of 4456	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	93
PID 5068 wrote to memory of 3292	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	98
PID 5068 wrote to memory of 3292	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	98
PID 5068 wrote to memory of 3292	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	98
PID 5068 wrote to memory of 912	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	103
PID 5068 wrote to memory of 912	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	103
PID 5068 wrote to memory of 912	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	103
PID 5068 wrote to memory of 1692	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	108
PID 5068 wrote to memory of 1692	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	108
PID 5068 wrote to memory of 1692	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	108
PID 5068 wrote to memory of 2164	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	111
PID 5068 wrote to memory of 2164	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	111
PID 5068 wrote to memory of 2164	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	111
PID 5068 wrote to memory of 4188	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	114
PID 5068 wrote to memory of 4188	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	114
PID 5068 wrote to memory of 4188	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	114
PID 5068 wrote to memory of 3776	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	117
PID 5068 wrote to memory of 3776	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	117
PID 5068 wrote to memory of 3776	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	117
PID 5068 wrote to memory of 4752	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	120
PID 5068 wrote to memory of 4752	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	120
PID 5068 wrote to memory of 4752	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	120
PID 5068 wrote to memory of 60	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	125
PID 5068 wrote to memory of 60	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	125
PID 5068 wrote to memory of 60	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	125
PID 5068 wrote to memory of 3856	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	130
PID 5068 wrote to memory of 3856	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	130
PID 5068 wrote to memory of 3856	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	130
PID 5068 wrote to memory of 1220	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 5068 wrote to memory of 1220	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 5068 wrote to memory of 1220	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 5068 wrote to memory of 2184	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	133
PID 5068 wrote to memory of 2184	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	133
PID 5068 wrote to memory of 2184	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	133
PID 5068 wrote to memory of 2572	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	137
PID 5068 wrote to memory of 2572	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	137
PID 5068 wrote to memory of 2572	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	137
PID 5068 wrote to memory of 2880	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	140
PID 5068 wrote to memory of 2880	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	140
PID 5068 wrote to memory of 2880	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	140
PID 5068 wrote to memory of 3676	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	143
PID 5068 wrote to memory of 3676	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	143
PID 5068 wrote to memory of 3676	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	143
PID 5068 wrote to memory of 392	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	146
PID 5068 wrote to memory of 392	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	146
PID 5068 wrote to memory of 392	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	146
PID 5068 wrote to memory of 2340	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	149
PID 5068 wrote to memory of 2340	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	149
PID 5068 wrote to memory of 2340	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	149
PID 5068 wrote to memory of 2108	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	152
PID 5068 wrote to memory of 2108	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	152
PID 5068 wrote to memory of 2108	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	152
PID 5068 wrote to memory of 2068	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	155
PID 5068 wrote to memory of 2068	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	155
PID 5068 wrote to memory of 2068	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	155
PID 5068 wrote to memory of 3940	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	158
PID 5068 wrote to memory of 3940	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	158
PID 5068 wrote to memory of 3940	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	158
PID 5068 wrote to memory of 3156	5068	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	161

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3856	attrib.exe

C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
"C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1120
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4456
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3292
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:912
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1692
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2164
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4188
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3776
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4752
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:60
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3856
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1220
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2184
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2572
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2880
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3676
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:392
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2340
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2108
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2068
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3940
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
  "C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3692
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3472
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IntelCore\IntelCore.exe

Filesize
178KB

MD5
1bba63e05240e16c87b4639d5ac20017

SHA1
6fe0811e3d024e4c0b86467930f2d61c074dee31

SHA256
c37a8b37cfaa7de5cfe06e16c52163fcfdfa588ac3b43e3161eb127821c6137d

SHA512
29de6dba3a7870dc9f8528b135890d43ee2a4e5f750cb32893c30f1848cbf30cac6915c6d0af137e66cb2c052ac1295a6eef474a47354f23a2b15d4267baabfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Filesize
178KB

MD5
fdd19703be4eef41ca88975b29887460

SHA1
ee92d74428a9b60aab301ecbe84247a4fa3987f6

SHA256
540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9

SHA512
f91c4a2d09622ff0b26c7c8e1bb0e3316b407978a6c4f00fe9f828239d8232fee6010f67aa386b67f394528bcb71043d9da04e7659b0bce8886973051c15c92e

Download Submit
memory/5068-0-0x0000000074872000-0x0000000074873000-memory.dmp

Filesize
4KB

Download
memory/5068-1-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/5068-2-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/5068-3-0x0000000074872000-0x0000000074873000-memory.dmp

Filesize
4KB

Download
memory/5068-4-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download