80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4

Analysis

max time kernel
118s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
Size 87KB
Sample241109-1trxjsslev
SHA256 80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4
MD5 db5f8a9bc5a5dce4348054f569ea6c20
SHA1 340f2dfa2f37a98dc8016678bdc0d6c1db4f9a4f
SHA512 1c362e26db3cd3231d4ddafe14d18f215fcd3ff7e57a321b868eba2587a935733ef4a3cb68ae5622f5f2b0990ae4ef278156d0c22cfc89ea07d79becd9a81b3e
SSDEEP 384:5bLwOs8AHsc4sM6whKiro54/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiro54/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}\stubpath = "C:\\Windows\\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe"	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5EEBEB-3686-4688-9FBF-326B3595B242}	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{415ACAFC-66E3-4ee1-8176-374205A7B318}\stubpath = "C:\\Windows\\{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe"	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}\stubpath = "C:\\Windows\\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe"	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}\stubpath = "C:\\Windows\\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe"	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}\stubpath = "C:\\Windows\\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe"	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{415ACAFC-66E3-4ee1-8176-374205A7B318}	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5EEBEB-3686-4688-9FBF-326B3595B242}\stubpath = "C:\\Windows\\{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe"	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}\stubpath = "C:\\Windows\\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe"	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8122371F-AA63-4021-964F-EE46F6AC3108}	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8122371F-AA63-4021-964F-EE46F6AC3108}\stubpath = "C:\\Windows\\{8122371F-AA63-4021-964F-EE46F6AC3108}.exe"	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}\stubpath = "C:\\Windows\\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe"	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe

Executes dropped EXE 9 IoCs

pid	Process
3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
4952	{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
File created	C:\Windows\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
File created	C:\Windows\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
File created	C:\Windows\{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
File created	C:\Windows\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
File created	C:\Windows\{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
File created	C:\Windows\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
File created	C:\Windows\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
File created	C:\Windows\{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
Token: SeIncBasePriorityPrivilege	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
Token: SeIncBasePriorityPrivilege	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
Token: SeIncBasePriorityPrivilege	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
Token: SeIncBasePriorityPrivilege	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
Token: SeIncBasePriorityPrivilege	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
Token: SeIncBasePriorityPrivilege	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
Token: SeIncBasePriorityPrivilege	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
Token: SeIncBasePriorityPrivilege	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3648	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	94
PID 4536 wrote to memory of 3648	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	94
PID 4536 wrote to memory of 3648	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	94
PID 4536 wrote to memory of 2180	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	95
PID 4536 wrote to memory of 2180	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	95
PID 4536 wrote to memory of 2180	4536	80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe	95
PID 3648 wrote to memory of 2492	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	102
PID 3648 wrote to memory of 2492	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	102
PID 3648 wrote to memory of 2492	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	102
PID 3648 wrote to memory of 3076	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	103
PID 3648 wrote to memory of 3076	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	103
PID 3648 wrote to memory of 3076	3648	{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe	103
PID 2492 wrote to memory of 364	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	107
PID 2492 wrote to memory of 364	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	107
PID 2492 wrote to memory of 364	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	107
PID 2492 wrote to memory of 1124	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	108
PID 2492 wrote to memory of 1124	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	108
PID 2492 wrote to memory of 1124	2492	{8122371F-AA63-4021-964F-EE46F6AC3108}.exe	108
PID 364 wrote to memory of 2952	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	109
PID 364 wrote to memory of 2952	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	109
PID 364 wrote to memory of 2952	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	109
PID 364 wrote to memory of 548	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	110
PID 364 wrote to memory of 548	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	110
PID 364 wrote to memory of 548	364	{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe	110
PID 2952 wrote to memory of 3436	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	111
PID 2952 wrote to memory of 3436	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	111
PID 2952 wrote to memory of 3436	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	111
PID 2952 wrote to memory of 768	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	112
PID 2952 wrote to memory of 768	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	112
PID 2952 wrote to memory of 768	2952	{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe	112
PID 3436 wrote to memory of 3016	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	113
PID 3436 wrote to memory of 3016	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	113
PID 3436 wrote to memory of 3016	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	113
PID 3436 wrote to memory of 4080	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	114
PID 3436 wrote to memory of 4080	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	114
PID 3436 wrote to memory of 4080	3436	{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe	114
PID 3016 wrote to memory of 2744	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	115
PID 3016 wrote to memory of 2744	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	115
PID 3016 wrote to memory of 2744	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	115
PID 3016 wrote to memory of 3344	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	116
PID 3016 wrote to memory of 3344	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	116
PID 3016 wrote to memory of 3344	3016	{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe	116
PID 2744 wrote to memory of 4656	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	117
PID 2744 wrote to memory of 4656	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	117
PID 2744 wrote to memory of 4656	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	117
PID 2744 wrote to memory of 3848	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	118
PID 2744 wrote to memory of 3848	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	118
PID 2744 wrote to memory of 3848	2744	{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe	118
PID 4656 wrote to memory of 4952	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	119
PID 4656 wrote to memory of 4952	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	119
PID 4656 wrote to memory of 4952	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	119
PID 4656 wrote to memory of 2924	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	120
PID 4656 wrote to memory of 2924	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	120
PID 4656 wrote to memory of 2924	4656	{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe	120

C:\Users\Admin\AppData\Local\Temp\80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe
"C:\Users\Admin\AppData\Local\Temp\80b4530fdc7364d3ab6f8cd3eaf56146d80bb08e2be322cc4c84d7329106c0c4N.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
  C:\Windows\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
    C:\Windows\{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
      C:\Windows\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\Windows\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
        
        C:\Windows\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
        
        C:\Windows\{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
        
        C:\Windows\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
        
        C:\Windows\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
        
        C:\Windows\{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe
        
        C:\Windows\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2B5EE~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1C9B~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CF53A~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{415AC~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AD85A~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:768
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49D5B~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{81223~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7752A~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\80B453~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe

Path C:\Windows\{2B5EEBEB-3686-4688-9FBF-326B3595B242}.exe
Size 87KB
SHA256 09befecd99aed4cfc9b71ef18025aa884bc3ddc059e5f491578512be4919de36
MD5 31a11d09f5a7471599766da308ebe455
SHA1 ee388d4d40014a51a632cd3b6c1047f55c3ca039
SHA512 bb65513797ecc85e41626562701b2739732ff695466d55d2435d9c2eef8edc50e62670d21954c7c99017143821b18bf3b7b7125d903dd0372d36d61fe12e1ae5
SSDEEP 384:5bLwOs8AHsc4sM6whKiroJ4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroJ4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe

Path C:\Windows\{415ACAFC-66E3-4ee1-8176-374205A7B318}.exe
Size 87KB
SHA256 f819636e28e5067d19fc6cf6568e2cd06e183336e48d190d5f2fd5c3278bf542
MD5 dbf66b8b9549f4cc3f8aef56b8d501ac
SHA1 fea209bae5a8fe24d596baf4c2125dac4551215a
SHA512 939fdbd23f97aade8562b6ba71e35ab102a3e02d8f3e8f56943aaf4941eee3f3f0e9d7e0d62acbd5c4198036a9a17e959a92d0f8f8735017bc4e5254f402175f
SSDEEP 384:5bLwOs8AHsc4sM6whKiroi4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroi4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe

Path C:\Windows\{49D5B3EB-AD96-4ace-90E0-5F1EA2A6E477}.exe
Size 87KB
SHA256 7bd1d03ec855780f2f5276309a1f298702e4caaedb400a1e1ec539155ac06422
MD5 d7247fa95e103223c34fa0c4a65bebc7
SHA1 165fa811d47e30e87881f2273a9831686aac4082
SHA512 2b514e1e3f438787d20f0b6c9759c0e0f6f2dd4506f744bebf152fca04adf25f1170be80731881de66c45aed4d37ef212eb60ab9dc2e93ac831aa3f9188c06d8
SSDEEP 384:5bLwOs8AHsc4sM6whKiroeq4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUU2:5vw9816uhKiron4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe

Path C:\Windows\{7752AE7F-816C-4b31-AB8B-3312BCF2E642}.exe
Size 87KB
SHA256 6ee8a41c77b267eb1c8674b662b03a2d52efe5a0ec84e4a8dbbb581cc7652a5e
MD5 a9743a6b15d893e84634e14cc4b69adf
SHA1 bed73de2901a76725ece01c761d8b65ebf2e7bf0
SHA512 1a66db64776f1c81194f5bbdc4205f9aa08bab127bee85d4d24762ef74e6b0416ff739298a463148197422e558fc2efd09ec4fe28c50f96d69cc4ab013d6fccc
SSDEEP 384:5bLwOs8AHsc4sM6whKirom4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKirom4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8122371F-AA63-4021-964F-EE46F6AC3108}.exe

Path C:\Windows\{8122371F-AA63-4021-964F-EE46F6AC3108}.exe
Size 87KB
SHA256 c21a94fc59d1cf8694c910e75f6df8f9fac831ef48b0e8af9df719e2cd2a9dbf
MD5 084b82714c86bf99a98edcaf49898eaa
SHA1 38f819e8fdd49f7024eac6f42f35538400ed614f
SHA512 1f8031fb57e3a0f1c37eb6c46e5792a04b5e3dbe9dc0aa75457c1ad2cbb6aed08e84447c960f06af17bc31c469eb22ce8b5de7fb422d7ef78aa405fc9479e46b
SSDEEP 384:5bLwOs8AHsc4sM6whKiroj4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroj4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe

Path C:\Windows\{A853373A-5429-4384-8EBD-BBE5A9A6B35E}.exe
Size 87KB
SHA256 15eae7080add824e0644f835a003f165191f640c9de4d036ffe94cc7253d2f7f
MD5 195e0a53aac5f6c749bbcf77fdf308e8
SHA1 81fa1601353eb273cc7e3ade6ad0ebc1618db5ea
SHA512 8fdd2d46b1855a57ea67ee8b365347c505c38ed3c8099f814e9e155a912de410d11b7cfaddccceca1950e5ccc96a8301ffef74497e0c3d16855a1c7d922bf207
SSDEEP 384:5bLwOs8AHsc4sM6whKiroz4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroz4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe

Path C:\Windows\{AD85A412-6819-43d7-82E3-811F3DF2D9E5}.exe
Size 87KB
SHA256 2b07d3e0a5e258f651558fe3935293dc5068fb00d89cb8d07d927e4babb3e7ce
MD5 99d4b85d9e0c68bc156f6a2e7c923078
SHA1 d91c8274f5fe5150c3a1dc54dfd013a5eb64d98d
SHA512 85afe8fd592b7f1c10c9f0281ad39b24a36a3c0b692c5a8a3440e332b780f79da5375e30b847d7a87f92a85df76fbef25b04e61f1f783afa1ef7eb928410ff01
SSDEEP 384:5bLwOs8AHsc4sM6whKiro24/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiro24/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe

Path C:\Windows\{B1C9B86A-1E21-44e1-90FB-0898FDB8B1BD}.exe
Size 87KB
SHA256 8d1e1de234e78312f5dbe3e5134aa5e27a9356aa7b70b22485c387e9c820fd17
MD5 ee61b83b3ddd10d5227e07ac09c089ad
SHA1 d2819ef3708589f5a52a222f2dbec4f46e617a1d
SHA512 23e65881221ec40d2faaffb15dc55271be760b3d8a6ffca97b730c5fdb9c5fa68edde310828fdd3879d53c832e22ade610531a05885b0d60f73760170fdd2f20
SSDEEP 384:5bLwOs8AHsc4sM6whKiroK4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroK4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe

Path C:\Windows\{CF53A818-5DE1-4dcd-BD46-EF94F9ED4B8E}.exe
Size 87KB
SHA256 27b890679afe0ed86659d354c11e8c6b57d612bd98cc389bf516ddc8f437dfeb
MD5 0c087d294bb115238451c6dde6ad5d9e
SHA1 0fb6730c66537cd20dcb8ced24b0953d1b9c1791
SHA512 df484c8b207f3d5fea68b67055c0693b7d80d1236071b78e7c6dad170cc1bba99b991d0eefc4477ee9fbb216279fafc94f4ce8993afca33098da412f09dd6f84
SSDEEP 384:5bLwOs8AHsc4sM6whKiroi4/CFsrdk5I1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUO3:5vw9816uhKiroi4/wQNNrfrunMxVFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-19-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/364-25-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2492-14-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2492-13-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2492-18-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2744-42-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2744-48-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2952-26-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2952-31-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3016-41-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3016-36-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3436-35-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3648-11-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3648-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4536-7-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4536-1-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4656-49-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4656-53-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4952-55-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads