Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
Resource
win10v2004-20241007-en
General
-
Target
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
-
Size
90KB
-
MD5
30a6d321480dda3cb2bc4c5c1bc991f4
-
SHA1
01ad7a2a16ed58745c86090b3e5e9c746beebe45
-
SHA256
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a
-
SHA512
9062facdfc86defd1a34caadefb207159d36c0e228ef08ed736d26886feea87b610431fb3569ab4beaa139800113633acbf93dc68692d44a543bf440b06f0780
-
SSDEEP
768:Qvw9816vhKQLro/4/wQRNrfrunMxVFA3b7glw:YEGh0o/l2unMxVS3Hg
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFE01639-8037-44d6-9ACF-0FB737D534AE}\stubpath = "C:\\Windows\\{FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe" {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC013546-185D-4d0f-8DFB-ABCEA8140B96} {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}\stubpath = "C:\\Windows\\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe" {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{806FA20A-28A1-43b8-83C1-8C0630611F10}\stubpath = "C:\\Windows\\{806FA20A-28A1-43b8-83C1-8C0630611F10}.exe" {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FFE01639-8037-44d6-9ACF-0FB737D534AE} {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68F41011-39B3-4aab-9587-AEAFD6BF98A3} {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68F41011-39B3-4aab-9587-AEAFD6BF98A3}\stubpath = "C:\\Windows\\{68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe" {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB} {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}\stubpath = "C:\\Windows\\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exe" {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}\stubpath = "C:\\Windows\\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe" 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E727827-C793-4462-8A94-B5E28E075295}\stubpath = "C:\\Windows\\{4E727827-C793-4462-8A94-B5E28E075295}.exe" {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{333DA285-29C9-49ba-96FD-1E957715E9C0} {4E727827-C793-4462-8A94-B5E28E075295}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81C74AD7-F4A3-4701-9849-81F792C94B13} {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC013546-185D-4d0f-8DFB-ABCEA8140B96}\stubpath = "C:\\Windows\\{CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe" {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}\stubpath = "C:\\Windows\\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe" {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6} {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{806FA20A-28A1-43b8-83C1-8C0630611F10} {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E727827-C793-4462-8A94-B5E28E075295} {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{333DA285-29C9-49ba-96FD-1E957715E9C0}\stubpath = "C:\\Windows\\{333DA285-29C9-49ba-96FD-1E957715E9C0}.exe" {4E727827-C793-4462-8A94-B5E28E075295}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81C74AD7-F4A3-4701-9849-81F792C94B13}\stubpath = "C:\\Windows\\{81C74AD7-F4A3-4701-9849-81F792C94B13}.exe" {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA} {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF} 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe -
Deletes itself 1 IoCs
pid Process 2776 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 1292 {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe 780 {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe 2148 {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe 1444 {3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe File created C:\Windows\{81C74AD7-F4A3-4701-9849-81F792C94B13}.exe {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe File created C:\Windows\{CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe File created C:\Windows\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe File created C:\Windows\{68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe File created C:\Windows\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe File created C:\Windows\{806FA20A-28A1-43b8-83C1-8C0630611F10}.exe {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe File created C:\Windows\{4E727827-C793-4462-8A94-B5E28E075295}.exe {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe File created C:\Windows\{333DA285-29C9-49ba-96FD-1E957715E9C0}.exe {4E727827-C793-4462-8A94-B5E28E075295}.exe File created C:\Windows\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exe {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe File created C:\Windows\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4E727827-C793-4462-8A94-B5E28E075295}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Token: SeIncBasePriorityPrivilege 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe Token: SeIncBasePriorityPrivilege 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe Token: SeIncBasePriorityPrivilege 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe Token: SeIncBasePriorityPrivilege 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe Token: SeIncBasePriorityPrivilege 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe Token: SeIncBasePriorityPrivilege 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe Token: SeIncBasePriorityPrivilege 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe Token: SeIncBasePriorityPrivilege 1292 {CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe Token: SeIncBasePriorityPrivilege 780 {14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe Token: SeIncBasePriorityPrivilege 2148 {68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2660 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 30 PID 2200 wrote to memory of 2660 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 30 PID 2200 wrote to memory of 2660 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 30 PID 2200 wrote to memory of 2660 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 30 PID 2200 wrote to memory of 2776 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 31 PID 2200 wrote to memory of 2776 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 31 PID 2200 wrote to memory of 2776 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 31 PID 2200 wrote to memory of 2776 2200 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 31 PID 2660 wrote to memory of 2544 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 33 PID 2660 wrote to memory of 2544 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 33 PID 2660 wrote to memory of 2544 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 33 PID 2660 wrote to memory of 2544 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 33 PID 2660 wrote to memory of 2672 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 34 PID 2660 wrote to memory of 2672 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 34 PID 2660 wrote to memory of 2672 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 34 PID 2660 wrote to memory of 2672 2660 {BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe 34 PID 2544 wrote to memory of 1644 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 35 PID 2544 wrote to memory of 1644 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 35 PID 2544 wrote to memory of 1644 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 35 PID 2544 wrote to memory of 1644 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 35 PID 2544 wrote to memory of 2196 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 36 PID 2544 wrote to memory of 2196 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 36 PID 2544 wrote to memory of 2196 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 36 PID 2544 wrote to memory of 2196 2544 {321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe 36 PID 1644 wrote to memory of 1088 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 37 PID 1644 wrote to memory of 1088 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 37 PID 1644 wrote to memory of 1088 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 37 PID 1644 wrote to memory of 1088 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 37 PID 1644 wrote to memory of 1820 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 38 PID 1644 wrote to memory of 1820 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 38 PID 1644 wrote to memory of 1820 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 38 PID 1644 wrote to memory of 1820 1644 {806FA20A-28A1-43b8-83C1-8C0630611F10}.exe 38 PID 1088 wrote to memory of 2224 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 39 PID 1088 wrote to memory of 2224 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 39 PID 1088 wrote to memory of 2224 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 39 PID 1088 wrote to memory of 2224 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 39 PID 1088 wrote to memory of 2376 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 40 PID 1088 wrote to memory of 2376 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 40 PID 1088 wrote to memory of 2376 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 40 PID 1088 wrote to memory of 2376 1088 {FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe 40 PID 2224 wrote to memory of 1152 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 41 PID 2224 wrote to memory of 1152 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 41 PID 2224 wrote to memory of 1152 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 41 PID 2224 wrote to memory of 1152 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 41 PID 2224 wrote to memory of 1472 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 42 PID 2224 wrote to memory of 1472 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 42 PID 2224 wrote to memory of 1472 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 42 PID 2224 wrote to memory of 1472 2224 {4E727827-C793-4462-8A94-B5E28E075295}.exe 42 PID 1152 wrote to memory of 2336 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 43 PID 1152 wrote to memory of 2336 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 43 PID 1152 wrote to memory of 2336 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 43 PID 1152 wrote to memory of 2336 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 43 PID 1152 wrote to memory of 1592 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 44 PID 1152 wrote to memory of 1592 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 44 PID 1152 wrote to memory of 1592 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 44 PID 1152 wrote to memory of 1592 1152 {333DA285-29C9-49ba-96FD-1E957715E9C0}.exe 44 PID 2336 wrote to memory of 1292 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 45 PID 2336 wrote to memory of 1292 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 45 PID 2336 wrote to memory of 1292 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 45 PID 2336 wrote to memory of 1292 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 45 PID 2336 wrote to memory of 1952 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 46 PID 2336 wrote to memory of 1952 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 46 PID 2336 wrote to memory of 1952 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 46 PID 2336 wrote to memory of 1952 2336 {81C74AD7-F4A3-4701-9849-81F792C94B13}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe"C:\Users\Admin\AppData\Local\Temp\221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exeC:\Windows\{BD7DF374-A28D-40fa-8B6D-E345CEBB81EF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exeC:\Windows\{321BDC50-D15A-4e57-8CAC-7FAF9E7C91C6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\{806FA20A-28A1-43b8-83C1-8C0630611F10}.exeC:\Windows\{806FA20A-28A1-43b8-83C1-8C0630611F10}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\{FFE01639-8037-44d6-9ACF-0FB737D534AE}.exeC:\Windows\{FFE01639-8037-44d6-9ACF-0FB737D534AE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\{4E727827-C793-4462-8A94-B5E28E075295}.exeC:\Windows\{4E727827-C793-4462-8A94-B5E28E075295}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\{333DA285-29C9-49ba-96FD-1E957715E9C0}.exeC:\Windows\{333DA285-29C9-49ba-96FD-1E957715E9C0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\{81C74AD7-F4A3-4701-9849-81F792C94B13}.exeC:\Windows\{81C74AD7-F4A3-4701-9849-81F792C94B13}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\{CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exeC:\Windows\{CC013546-185D-4d0f-8DFB-ABCEA8140B96}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1292 -
C:\Windows\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exeC:\Windows\{14C807C4-A2D5-4e10-B4F3-6B1335F4B0EA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\{68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exeC:\Windows\{68F41011-39B3-4aab-9587-AEAFD6BF98A3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exeC:\Windows\{3EA854E4-8FBF-49c3-A70A-3617FD88AEDB}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68F41~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14C80~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC013~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81C74~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{333DA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E727~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFE01~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{806FA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{321BD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD7DF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\221D6A~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5e0f0440074bac29487ae52eb52634b78
SHA1b56a43dbdfb1901dc38ba9a8506ad60dbf4e43a2
SHA25628b4964ade4464effa0e1a855b2497630ed3e6bb63d278451e9280aad4a5fe7d
SHA512c14a41aedef224832e5fec7814d6e0c0a00238be62836ec1e21379e47e15dbdf99334f3e32e72d1316b1f0d6d2d409fa0a1ca2e305b947f8e047c3c60563c195
-
Filesize
90KB
MD54adb2c4cee2053230f3392c38d69597f
SHA12cfc699b05e2f127cc192093fdc0303ec058325c
SHA2567cfea42038a6e93d5c5cfbc9bbeac508406055ec08fae51dc6923939e5f94c56
SHA5127823e0d63d33f227ec3a1ad2d2a69ebce4aea59bd33a1e96be7aecb4695e2f0e41fbcdf2df2411c760aa97eb000f54f553ccc2869572d0d5e13959c1e38147db
-
Filesize
90KB
MD5cc62a883d244153a1dd9cc6dc86837bc
SHA1ecc28bc0779911f7e543675100639d1f0684ea9c
SHA256d928164fee36322a7116193d9e65d66c9bb4fb3af265b04ba04acefd6fb7b8ba
SHA5126826e6c0d1630b234afd764cffc4bd1455327fb11994de207594881b0866a0fad3fbcffd72edf9a531964c3629ba49251afef8d0c5510b84f67edc43f48c37ee
-
Filesize
90KB
MD502fe8e3e099e0236a313dc2f3d651244
SHA1a6338936f2d302923c8f0e3a3328d2664099d078
SHA256acec59430595dec6f1d44e055270835ac396107473598b68bec6477ad3e6eb52
SHA512b61eb0451f2904fab2d177b28d15a82f5994da48057fbd01939e97eca63fc0638990fa64fbe5e47356989d976a3be97c99cfe05bd469a664bba4f17e1273c97e
-
Filesize
90KB
MD5684d2213fe3435a7667ecf3d48889d79
SHA103194886726475bb2e683b4a0bbad43cb800e9c4
SHA25678727e5627f51083d2e32c76a9a00155d9a4382aff51aa30d5fb1756336a28ea
SHA512224af68bf9049be1ce2969b8ab7a556877fdf1a38575321b3d0a0624bef4516083b37b3a3e15da4b3e62e5e2d4f942c821beb6dca1bfcb5c47969aac39e9af6b
-
Filesize
90KB
MD590d9e2b0f302fb7a21d68b62682f4c99
SHA14372e08932a3067a1b4c4335e6ede8b3ec638b92
SHA256ddb646aadc3b95adbefd882e839b37da5d67f93142ef69f4de579599bd221838
SHA51266793eee94e25267ab8bc22b33ecf0fec1fe7b26a712242ab79131cf40edd6d8ee035d9cfc15fa0c14d0c81e8a05345963a3cb31f85523503b07622511cef520
-
Filesize
90KB
MD5f56397d6d5b289c2d5a485244041c274
SHA1d53b73ba9a9240a62d1f27a90ee77a62cb1f9678
SHA256fd73b7b3b26b41703ff7af792f95b2fa9b240af806accad15b6771f9dd21cd48
SHA5126d6d895bb6406d09d8da805aadfcdd01e689e5c076dc94ddc2b68a1bac362f88553d8c292f8a2ea68485f10d6b7cf89605973ef89407fe677ebdc491726ef117
-
Filesize
90KB
MD5f5f5827cce390bb883f14eb10dc21d44
SHA15be68615a08e5f7cdff6bd5cc636ff94d2f919bc
SHA256b8adc5641110f385c27d671377bde963e046109027305b7812c52567253c99f8
SHA5126bc430005f1e57096a27cb9cd315370c9c162382a7820bb882a1fdf89e6bf4996aff8f093b4cd77dd1ea71a2c24c7402c6132905bbe932590533f38a8b5ef313
-
Filesize
90KB
MD5ecca7a9d9c9a50c40392ce7bb1190a06
SHA154b356ca54e79b983ca7c678ec0b61acbc5a246c
SHA2569f427b283b75b347f8ed75102160f06141f1eaad66c197f3ee319145b817bfff
SHA5129fbff5663ab89059cc1c58c607ddedda78ef31922fe57590680038844566b4124bfc29e90dd5272ade6e33e45935658d84e4ccb8d87c9fdb8b1301aa685794fb
-
Filesize
90KB
MD549cba099509e5458c2893a5a00bbdca3
SHA17c3f973ddbb5ddd7c84a7a00d08f40092473d301
SHA256ad86b16a2c156e544a9f2e1219198dffc7dbde2cd6dd3028f84fd37f77142cc4
SHA512f76adceb8225d479b25fc1244fce249502e0766b247014b82e7b924093ad3849b413dfc48b8a753b073e0e4ac887a67e109d4b4fcf436ab770e79e5f2e705176
-
Filesize
90KB
MD56f7734a8f8f9bc0d758d6d5dcb4f5b65
SHA18fb934490984d40fc422f361f0d22ae14470c683
SHA2560956cc9fb2df8f0b80471f9fcdabf15d10477727864bab9a88770f431bd4dfe0
SHA512f66b83d465d5fef41a7478af2d87d13d35110c6f4fb6a424b0e95b1633f7095a11b7f04e9cd1887a3e7190b7ea66a203fcd34dd48e9a7059e6bf2072d60aa13a