Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
Resource
win10v2004-20241007-en
General
-
Target
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe
-
Size
90KB
-
MD5
30a6d321480dda3cb2bc4c5c1bc991f4
-
SHA1
01ad7a2a16ed58745c86090b3e5e9c746beebe45
-
SHA256
221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a
-
SHA512
9062facdfc86defd1a34caadefb207159d36c0e228ef08ed736d26886feea87b610431fb3569ab4beaa139800113633acbf93dc68692d44a543bf440b06f0780
-
SSDEEP
768:Qvw9816vhKQLro/4/wQRNrfrunMxVFA3b7glw:YEGh0o/l2unMxVS3Hg
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F} {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F}\stubpath = "C:\\Windows\\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe" {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06} {AEAA7FFB-0DBB-4661-9267-664930637360}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC79949B-7A6A-475c-A651-426D690CD70E}\stubpath = "C:\\Windows\\{AC79949B-7A6A-475c-A651-426D690CD70E}.exe" {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4} {AC79949B-7A6A-475c-A651-426D690CD70E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0380B552-6A05-4f10-B8EA-7EEECC384B32}\stubpath = "C:\\Windows\\{0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe" {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B0EE301-9981-4641-8F1B-05C5D08A7146} {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B0EE301-9981-4641-8F1B-05C5D08A7146}\stubpath = "C:\\Windows\\{2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe" {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28} {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28}\stubpath = "C:\\Windows\\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe" {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4}\stubpath = "C:\\Windows\\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe" {AC79949B-7A6A-475c-A651-426D690CD70E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3044246-53D8-40b8-A00F-50DBED6B20A8} {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0380B552-6A05-4f10-B8EA-7EEECC384B32} {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F856CE32-CC60-4296-995C-BE5FF262C76D}\stubpath = "C:\\Windows\\{F856CE32-CC60-4296-995C-BE5FF262C76D}.exe" {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEAA7FFB-0DBB-4661-9267-664930637360}\stubpath = "C:\\Windows\\{AEAA7FFB-0DBB-4661-9267-664930637360}.exe" 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C} {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}\stubpath = "C:\\Windows\\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe" {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94} {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC79949B-7A6A-475c-A651-426D690CD70E} {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3044246-53D8-40b8-A00F-50DBED6B20A8}\stubpath = "C:\\Windows\\{B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe" {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F856CE32-CC60-4296-995C-BE5FF262C76D} {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEAA7FFB-0DBB-4661-9267-664930637360} 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06}\stubpath = "C:\\Windows\\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe" {AEAA7FFB-0DBB-4661-9267-664930637360}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}\stubpath = "C:\\Windows\\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe" {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe -
Executes dropped EXE 12 IoCs
pid Process 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe 2404 {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe 3420 {F856CE32-CC60-4296-995C-BE5FF262C76D}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe File created C:\Windows\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe File created C:\Windows\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe File created C:\Windows\{B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe File created C:\Windows\{0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe File created C:\Windows\{2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe File created C:\Windows\{AEAA7FFB-0DBB-4661-9267-664930637360}.exe 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe File created C:\Windows\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe {AEAA7FFB-0DBB-4661-9267-664930637360}.exe File created C:\Windows\{AC79949B-7A6A-475c-A651-426D690CD70E}.exe {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe File created C:\Windows\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe {AC79949B-7A6A-475c-A651-426D690CD70E}.exe File created C:\Windows\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe File created C:\Windows\{F856CE32-CC60-4296-995C-BE5FF262C76D}.exe {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe -
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {AC79949B-7A6A-475c-A651-426D690CD70E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {AEAA7FFB-0DBB-4661-9267-664930637360}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F856CE32-CC60-4296-995C-BE5FF262C76D}.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe Token: SeIncBasePriorityPrivilege 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe Token: SeIncBasePriorityPrivilege 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe Token: SeIncBasePriorityPrivilege 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe Token: SeIncBasePriorityPrivilege 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe Token: SeIncBasePriorityPrivilege 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe Token: SeIncBasePriorityPrivilege 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe Token: SeIncBasePriorityPrivilege 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe Token: SeIncBasePriorityPrivilege 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe Token: SeIncBasePriorityPrivilege 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe Token: SeIncBasePriorityPrivilege 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe Token: SeIncBasePriorityPrivilege 2404 {2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 5068 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 100 PID 2284 wrote to memory of 5068 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 100 PID 2284 wrote to memory of 5068 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 100 PID 2284 wrote to memory of 4924 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 101 PID 2284 wrote to memory of 4924 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 101 PID 2284 wrote to memory of 4924 2284 221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe 101 PID 5068 wrote to memory of 1756 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 102 PID 5068 wrote to memory of 1756 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 102 PID 5068 wrote to memory of 1756 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 102 PID 5068 wrote to memory of 772 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 103 PID 5068 wrote to memory of 772 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 103 PID 5068 wrote to memory of 772 5068 {AEAA7FFB-0DBB-4661-9267-664930637360}.exe 103 PID 1756 wrote to memory of 2804 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 107 PID 1756 wrote to memory of 2804 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 107 PID 1756 wrote to memory of 2804 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 107 PID 1756 wrote to memory of 1584 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 108 PID 1756 wrote to memory of 1584 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 108 PID 1756 wrote to memory of 1584 1756 {DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe 108 PID 2804 wrote to memory of 4356 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 109 PID 2804 wrote to memory of 4356 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 109 PID 2804 wrote to memory of 4356 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 109 PID 2804 wrote to memory of 3088 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 110 PID 2804 wrote to memory of 3088 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 110 PID 2804 wrote to memory of 3088 2804 {E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe 110 PID 4356 wrote to memory of 1608 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 111 PID 4356 wrote to memory of 1608 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 111 PID 4356 wrote to memory of 1608 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 111 PID 4356 wrote to memory of 4072 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 112 PID 4356 wrote to memory of 4072 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 112 PID 4356 wrote to memory of 4072 4356 {BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe 112 PID 1608 wrote to memory of 540 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 113 PID 1608 wrote to memory of 540 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 113 PID 1608 wrote to memory of 540 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 113 PID 1608 wrote to memory of 2620 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 114 PID 1608 wrote to memory of 2620 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 114 PID 1608 wrote to memory of 2620 1608 {7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe 114 PID 540 wrote to memory of 1996 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 115 PID 540 wrote to memory of 1996 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 115 PID 540 wrote to memory of 1996 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 115 PID 540 wrote to memory of 4372 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 116 PID 540 wrote to memory of 4372 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 116 PID 540 wrote to memory of 4372 540 {AC79949B-7A6A-475c-A651-426D690CD70E}.exe 116 PID 1996 wrote to memory of 672 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 117 PID 1996 wrote to memory of 672 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 117 PID 1996 wrote to memory of 672 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 117 PID 1996 wrote to memory of 3484 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 118 PID 1996 wrote to memory of 3484 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 118 PID 1996 wrote to memory of 3484 1996 {9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe 118 PID 672 wrote to memory of 1580 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 119 PID 672 wrote to memory of 1580 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 119 PID 672 wrote to memory of 1580 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 119 PID 672 wrote to memory of 1400 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 120 PID 672 wrote to memory of 1400 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 120 PID 672 wrote to memory of 1400 672 {B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe 120 PID 1580 wrote to memory of 3520 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 121 PID 1580 wrote to memory of 3520 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 121 PID 1580 wrote to memory of 3520 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 121 PID 1580 wrote to memory of 2508 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 122 PID 1580 wrote to memory of 2508 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 122 PID 1580 wrote to memory of 2508 1580 {A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe 122 PID 3520 wrote to memory of 2404 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe 123 PID 3520 wrote to memory of 2404 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe 123 PID 3520 wrote to memory of 2404 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe 123 PID 3520 wrote to memory of 2360 3520 {0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe"C:\Users\Admin\AppData\Local\Temp\221d6a60fc8d77ae7619db2877f035d0f09e3796f44689c7f100c90cc38e636a.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\{AEAA7FFB-0DBB-4661-9267-664930637360}.exeC:\Windows\{AEAA7FFB-0DBB-4661-9267-664930637360}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exeC:\Windows\{DF3D6E42-7FF0-4ed3-836D-51066DD89D06}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exeC:\Windows\{E11DDE14-ABB3-429b-BA7C-6F73EE5E3A8C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exeC:\Windows\{BE3EADC8-6860-4d46-B877-E9FD5DE4BB94}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exeC:\Windows\{7CBBC9BB-7FF3-43c9-8977-616ADA848D28}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\{AC79949B-7A6A-475c-A651-426D690CD70E}.exeC:\Windows\{AC79949B-7A6A-475c-A651-426D690CD70E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exeC:\Windows\{9862EE19-CD7B-461d-97F7-3178E8DC3DF4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\{B3044246-53D8-40b8-A00F-50DBED6B20A8}.exeC:\Windows\{B3044246-53D8-40b8-A00F-50DBED6B20A8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exeC:\Windows\{A1C886AF-0A32-4744-A9C9-FEAC9B45823F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\{0380B552-6A05-4f10-B8EA-7EEECC384B32}.exeC:\Windows\{0380B552-6A05-4f10-B8EA-7EEECC384B32}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\{2B0EE301-9981-4641-8F1B-05C5D08A7146}.exeC:\Windows\{2B0EE301-9981-4641-8F1B-05C5D08A7146}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\{F856CE32-CC60-4296-995C-BE5FF262C76D}.exeC:\Windows\{F856CE32-CC60-4296-995C-BE5FF262C76D}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B0EE~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
PID:4600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0380B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1C88~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3044~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:1400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9862E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC799~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7CBBC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE3EA~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E11DD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:3088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF3D6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:1584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEAA7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\221D6A~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:4924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD567e235d0a385e4e4b056267b3792a983
SHA14ee3f316cfcc4c96d6217f5160b0af4d8132a734
SHA256b535f3fe06da3c855211d17ec75587bbe1dfcd8cf6ab27e871178327ba45a004
SHA51216238c153b0b762bc0b32a383a0accd544f753e98029bcfff571280376df087ccd0f63e5336ce56d2f6f9ddd200ab0be95bcecea2a25623bbe9eb0029f909a30
-
Filesize
90KB
MD5319c3ea26eb77cb2600a3eab7b35986d
SHA1bf9e8ed702f03090585a7c3f2abcf61f67fb9d7d
SHA256ada1ad0d602db58ae7e0254f1c11cbeb87a42f8cb1ab1a546bbeccd0cc28b27c
SHA512a1f378a71aaf1910c01391fe244e90684f7c212362885d5c52440d375c1e8f5cd063223d625213096e418200294e1140ccf99f34a7658eb128176deea29db6e8
-
Filesize
90KB
MD5c75f9909291fb0e57cc6336420dc416d
SHA135a3a1340fafb58b3988de0d308ed8171e752934
SHA2564b10f42c4af86467ddf0e53b1890a3ab44b31c5d53caae29f84e2bd617bd3abb
SHA512d9f50cec803f0c3156c523532a137aedea13608b6b99a44ccb8e67b8a2abc4b7ba52b79f2378c7e8b1d5a03e2cf9b3fc9e530afa4b68e42912a0bc680e51bcbd
-
Filesize
90KB
MD570901328e4abf0b2199e690bf34878c2
SHA1b2f354a27e934b7210e33ce98dbd38c1a58653ff
SHA2568fbe90ff7f68303cef628fda5b52ca40217b64f20e64690a8f09579b94655efc
SHA51260d3a6578cfc9497b9d832d87f19855e18deb4a382e061404a7d6cd06cde4cd897e50ec391e1d1ed0f4739d3b58a2a423577a4465c162da156368d1a3bf85c22
-
Filesize
90KB
MD5c5506a1fc2d37f41aa86df28910f5981
SHA18b0504fc770815c9b5b9a2bcbc401db10d078a93
SHA256a82b95ff4b4aad8fed08f5af247a246eaee8ae524ec604b2a133adacb3a183fc
SHA512116edf39be420bbfe03e233b8ad1e17ab7f6eedaff6c05294465014a60e4af94a58dc423a42b9c0f1b00d540e03ee7b6e25d793b5cb64fc3c945b898b5bb43a7
-
Filesize
90KB
MD53bb618823146cf7d16437f28ead95527
SHA174a52432ece42863146bdbac8ee1a065506291b0
SHA25665ddcbf24e8db9038cfdc37a0c2a61c614492d0e83dbc8935c784f91fdf4d288
SHA512cf6f738ef329f6f59980b7d9d3700990e0ffabfe33e40f09380112b0eaa3a48163add3af657a129275a76cac084a30b291369030a4810256c482e74a15b78472
-
Filesize
90KB
MD505ac59ff6861b8c318708d23ec35a3fb
SHA1b54ef50fe8e5ffda28660fc9709ce3f8ca5a39c4
SHA256e48fbd8fc847f50d6f1bc0ca8ff4145ab5bfa66ae60d8bd3f5ae7ac2f697d997
SHA512ebe388dd3a223e378c451c36989ee0d93df5ef06275b5c1549daa2f595810f1312cac1747a642b7971a391294abfb346311faa7b32b203ee057b18b557e28fa4
-
Filesize
90KB
MD52a29295af098067b5d56300cb3ecc5b3
SHA1fd686e88f85e21029b9bb38bb226427428b2a9da
SHA2566c94526a3f7a0c550c57de2131425c42c52a9d77d83dbfc4bf19f7001bc422e7
SHA512258dc5188019edce06bb03cf0a1479b905eaa1dd6ef959b31b7dd3d409e19d392204b70b75e298c45ef0cf1d9341cd7724ef6da5c4903ac0a382f76d611fa70b
-
Filesize
90KB
MD509c33b72e164d76177455d88e503c156
SHA1789f2cf97eb25b962655e2e5a263b7a6d24eae4b
SHA25654cb7037f2bcc83acc865d45b170194e853177cf89c34c842ed66bc549532f48
SHA512a6f5c9bd59a79d0c67b78088327629aa6772ae025e15255367b294b965796ec41ddebb2f14ca15a3980af69724e0747ed3adc1073defc99ca397184c26fb58ef
-
Filesize
90KB
MD510adf0b43ec21e6d2b8d01920bc559c0
SHA1ba13708ba2e4e70d60f4e8ca819bd184d4f350a6
SHA256ddc8c70c83837d095b24627d61e14480a317a4a31ffdaed586874a19141d6dd7
SHA512fb34b4d8d4c43fa277889bdc4bde1f5f0021d4b58006bed682fb7ea20e12e83eb006d1824b96d221a461f0ba56455229851ccd55094054dcca7b09b705efdda9
-
Filesize
90KB
MD550bf7ee6ac0eeaaf502912f3f5c8fdf1
SHA146ba283dd15c6d6531b3ca3770486472b728ef2b
SHA256293e2d3717e7466355874f9e0c4154302543d0326216163c11902d785fd234cf
SHA5127bdd9097612893407e902fb075d5336a4d5b7afe982a723021613dab5961353269212eeb2aa83836a4b99961792a26495e80f64b2f87fd78038b2238c93f2e88
-
Filesize
90KB
MD5f347439c3f63c73200083a06ce391785
SHA1eaab98cda111cd523867a68c5341a1af5df9bbd7
SHA256dffe782e19572cc04d9d05842bf07a0e3d3b99c4ac2d41a1473ad90cbf853c59
SHA51270350345c093914f40c74ae6c8c25d4bbf24190b30f02d2b6f127d746eb3e06de5eab7c67a5e76207392e8de85a06053bae0109b65b3f9dfde79dd8de79be72a