540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9

Analysis

max time kernel
146s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
Size

178KB
MD5

fdd19703be4eef41ca88975b29887460
SHA1

ee92d74428a9b60aab301ecbe84247a4fa3987f6
SHA256

540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9
SHA512

f91c4a2d09622ff0b26c7c8e1bb0e3316b407978a6c4f00fe9f828239d8232fee6010f67aa386b67f394528bcb71043d9da04e7659b0bce8886973051c15c92e
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28/

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2288	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3136	ping.exe
2696	ping.exe
2828	ping.exe
3700	ping.exe
2220	ping.exe
1712	ping.exe
60	ping.exe
3328	ping.exe
4032	ping.exe
1564	ping.exe
2340	ping.exe
4188	ping.exe
1308	ping.exe
1480	ping.exe
4628	ping.exe
1516	ping.exe
3576	ping.exe
1212	ping.exe
1764	ping.exe
3376	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
1308	ping.exe
1764	ping.exe
2828	ping.exe
1564	ping.exe
2696	ping.exe
3328	ping.exe
3700	ping.exe
2340	ping.exe
3576	ping.exe
1212	ping.exe
1480	ping.exe
1712	ping.exe
3376	ping.exe
4628	ping.exe
1516	ping.exe
4188	ping.exe
2220	ping.exe
3136	ping.exe
4032	ping.exe
60	ping.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2340	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	85
PID 3532 wrote to memory of 2340	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	85
PID 3532 wrote to memory of 2340	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	85
PID 3532 wrote to memory of 3576	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	94
PID 3532 wrote to memory of 3576	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	94
PID 3532 wrote to memory of 3576	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	94
PID 3532 wrote to memory of 4188	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	99
PID 3532 wrote to memory of 4188	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	99
PID 3532 wrote to memory of 4188	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	99
PID 3532 wrote to memory of 1308	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	104
PID 3532 wrote to memory of 1308	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	104
PID 3532 wrote to memory of 1308	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	104
PID 3532 wrote to memory of 2220	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	109
PID 3532 wrote to memory of 2220	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	109
PID 3532 wrote to memory of 2220	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	109
PID 3532 wrote to memory of 3136	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	112
PID 3532 wrote to memory of 3136	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	112
PID 3532 wrote to memory of 3136	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	112
PID 3532 wrote to memory of 1212	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	115
PID 3532 wrote to memory of 1212	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	115
PID 3532 wrote to memory of 1212	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	115
PID 3532 wrote to memory of 1480	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	118
PID 3532 wrote to memory of 1480	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	118
PID 3532 wrote to memory of 1480	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	118
PID 3532 wrote to memory of 4032	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	121
PID 3532 wrote to memory of 4032	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	121
PID 3532 wrote to memory of 4032	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	121
PID 3532 wrote to memory of 1564	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	124
PID 3532 wrote to memory of 1564	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	124
PID 3532 wrote to memory of 1564	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	124
PID 3532 wrote to memory of 2288	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	129
PID 3532 wrote to memory of 2288	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	129
PID 3532 wrote to memory of 2288	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	129
PID 3532 wrote to memory of 4128	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	131
PID 3532 wrote to memory of 4128	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	131
PID 3532 wrote to memory of 4128	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	131
PID 3532 wrote to memory of 1764	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 3532 wrote to memory of 1764	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 3532 wrote to memory of 1764	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	132
PID 3532 wrote to memory of 1712	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	138
PID 3532 wrote to memory of 1712	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	138
PID 3532 wrote to memory of 1712	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	138
PID 3532 wrote to memory of 60	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	141
PID 3532 wrote to memory of 60	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	141
PID 3532 wrote to memory of 60	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	141
PID 3532 wrote to memory of 3376	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	144
PID 3532 wrote to memory of 3376	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	144
PID 3532 wrote to memory of 3376	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	144
PID 3532 wrote to memory of 2696	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	147
PID 3532 wrote to memory of 2696	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	147
PID 3532 wrote to memory of 2696	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	147
PID 3532 wrote to memory of 3328	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	150
PID 3532 wrote to memory of 3328	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	150
PID 3532 wrote to memory of 3328	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	150
PID 3532 wrote to memory of 2828	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	153
PID 3532 wrote to memory of 2828	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	153
PID 3532 wrote to memory of 2828	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	153
PID 3532 wrote to memory of 4628	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	156
PID 3532 wrote to memory of 4628	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	156
PID 3532 wrote to memory of 4628	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	156
PID 3532 wrote to memory of 3700	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	159
PID 3532 wrote to memory of 3700	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	159
PID 3532 wrote to memory of 3700	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	159
PID 3532 wrote to memory of 1516	3532	540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe	163

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2288	attrib.exe

C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
"C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2340
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3576
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4188
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1308
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2220
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3136
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1212
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1480
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4032
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1564
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2288
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4128
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1764
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1712
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:60
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3376
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2696
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3328
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2828
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4628
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3700
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe
  "C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe"
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3996
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1772
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:688
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2216
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3956
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4648
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IntelCore\IntelCore.exe

Filesize
178KB

MD5
e6a9d779526f02e1450f4be147e86fc3

SHA1
57addf7f3fa57a0182a271fc8d70b0a04a58c6ef

SHA256
6053a93ccf48de20110fc2e930eddc163083fa6b9be1e067cac0b5aa3f5e9ace

SHA512
d83262a78768a29cdadef1a72fba15509bc9da7b3ff101636e5cada7dfeb9f25525423a72e10481dcfae8fe880327ef566ef128380446ee322fc194ca1ab7f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N.exe

Filesize
178KB

MD5
fdd19703be4eef41ca88975b29887460

SHA1
ee92d74428a9b60aab301ecbe84247a4fa3987f6

SHA256
540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9

SHA512
f91c4a2d09622ff0b26c7c8e1bb0e3316b407978a6c4f00fe9f828239d8232fee6010f67aa386b67f394528bcb71043d9da04e7659b0bce8886973051c15c92e

Download Submit
memory/3532-0-0x0000000075382000-0x0000000075383000-memory.dmp

Filesize
4KB

Download
memory/3532-1-0x0000000075380000-0x0000000075931000-memory.dmp

Filesize
5.7MB

Download
memory/3532-2-0x0000000075380000-0x0000000075931000-memory.dmp

Filesize
5.7MB

Download
memory/3532-3-0x0000000075382000-0x0000000075383000-memory.dmp

Filesize
4KB

Download
memory/3532-4-0x0000000075380000-0x0000000075931000-memory.dmp

Filesize
5.7MB

Download