24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c

Analysis

max time kernel
115s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
Size

349KB
MD5

0cf9394290c86066be37f994f0216970
SHA1

9c635196722a2b0060078df98509f9dd9ef15330
SHA256

24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c
SHA512

a5b586de5bdd56a0969c5d77a0cfd57576d71feea4659e6db65cf3b3844862a7b93ce600bccfaa8f7604f7845b92527b156834e20f4a8e2e0a225323d57faba8
SSDEEP

6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIK:FB1Q6rpr7MrswfLjGwW5xFdRyJpL

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4560	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2912	ping.exe
1404	ping.exe
592	ping.exe
2844	ping.exe
3928	ping.exe
4052	ping.exe
5072	ping.exe
4392	ping.exe
3648	ping.exe
884	ping.exe
4000	ping.exe
4944	ping.exe
2884	ping.exe
4832	ping.exe
2508	ping.exe
3184	ping.exe
4364	ping.exe
1160	ping.exe
4960	ping.exe
3892	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
5072	ping.exe
4392	ping.exe
3648	ping.exe
4052	ping.exe
4960	ping.exe
1404	ping.exe
4832	ping.exe
2844	ping.exe
3892	ping.exe
592	ping.exe
3184	ping.exe
4944	ping.exe
2884	ping.exe
2912	ping.exe
2508	ping.exe
884	ping.exe
4364	ping.exe
3928	ping.exe
1160	ping.exe
4000	ping.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	97
PID 4940 wrote to memory of 884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	97
PID 4940 wrote to memory of 884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	97
PID 4940 wrote to memory of 4000	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	104
PID 4940 wrote to memory of 4000	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	104
PID 4940 wrote to memory of 4000	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	104
PID 4940 wrote to memory of 3184	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	107
PID 4940 wrote to memory of 3184	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	107
PID 4940 wrote to memory of 3184	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	107
PID 4940 wrote to memory of 4364	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	110
PID 4940 wrote to memory of 4364	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	110
PID 4940 wrote to memory of 4364	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	110
PID 4940 wrote to memory of 4944	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	113
PID 4940 wrote to memory of 4944	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	113
PID 4940 wrote to memory of 4944	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	113
PID 4940 wrote to memory of 4960	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	116
PID 4940 wrote to memory of 4960	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	116
PID 4940 wrote to memory of 4960	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	116
PID 4940 wrote to memory of 1404	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	119
PID 4940 wrote to memory of 1404	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	119
PID 4940 wrote to memory of 1404	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	119
PID 4940 wrote to memory of 2884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	122
PID 4940 wrote to memory of 2884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	122
PID 4940 wrote to memory of 2884	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	122
PID 4940 wrote to memory of 4832	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	127
PID 4940 wrote to memory of 4832	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	127
PID 4940 wrote to memory of 4832	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	127
PID 4940 wrote to memory of 2844	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	132
PID 4940 wrote to memory of 2844	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	132
PID 4940 wrote to memory of 2844	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	132
PID 4940 wrote to memory of 3244	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	135
PID 4940 wrote to memory of 3244	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	135
PID 4940 wrote to memory of 3244	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	135
PID 4940 wrote to memory of 4560	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	136
PID 4940 wrote to memory of 4560	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	136
PID 4940 wrote to memory of 4560	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	136
PID 4940 wrote to memory of 3928	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	138
PID 4940 wrote to memory of 3928	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	138
PID 4940 wrote to memory of 3928	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	138
PID 4940 wrote to memory of 3892	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	141
PID 4940 wrote to memory of 3892	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	141
PID 4940 wrote to memory of 3892	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	141
PID 4940 wrote to memory of 4052	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	144
PID 4940 wrote to memory of 4052	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	144
PID 4940 wrote to memory of 4052	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	144
PID 4940 wrote to memory of 592	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	147
PID 4940 wrote to memory of 592	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	147
PID 4940 wrote to memory of 592	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	147
PID 4940 wrote to memory of 5072	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	150
PID 4940 wrote to memory of 5072	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	150
PID 4940 wrote to memory of 5072	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	150
PID 4940 wrote to memory of 4392	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	153
PID 4940 wrote to memory of 4392	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	153
PID 4940 wrote to memory of 4392	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	153
PID 4940 wrote to memory of 1160	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	156
PID 4940 wrote to memory of 1160	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	156
PID 4940 wrote to memory of 1160	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	156
PID 4940 wrote to memory of 2912	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	159
PID 4940 wrote to memory of 2912	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	159
PID 4940 wrote to memory of 2912	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	159
PID 4940 wrote to memory of 2508	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	162
PID 4940 wrote to memory of 2508	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	162
PID 4940 wrote to memory of 2508	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	162
PID 4940 wrote to memory of 3648	4940	24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe	166

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4560	attrib.exe

C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
"C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:884
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4000
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3184
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4364
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4944
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4960
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1404
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2884
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4832
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3244
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93cN.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4560
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3928
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3892
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4052
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:592
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5072
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4392
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1160
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2912
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2508
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3648
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:980
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:768
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1876
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4888
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1492
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe

Filesize
349KB

MD5
2427049b7979c2fdc5005f534febed5b

SHA1
baf9b92625e0a26f433bf104b06b678f7af6e1eb

SHA256
35ed87cfcfe241726f9e9f8fd7bc49936507e41c2a1575834662e6d514f7f2cb

SHA512
091e1b962a930e81746f1d3e51c75d2164b11309331b49e89bce7d3e865fa876b4916b92b7b402081646eae6c378a82fa630d0985c3f9fd23a9083d895fac331

Download Submit
memory/4940-0-0x0000000074A22000-0x0000000074A23000-memory.dmp

Filesize
4KB

Download
memory/4940-1-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/4940-2-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/4940-4-0x0000000074A22000-0x0000000074A23000-memory.dmp

Filesize
4KB

Download
memory/4940-5-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download