Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
Resource
win10v2004-20241007-en
General
-
Target
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
-
Size
79KB
-
MD5
ead7f6b3af34c9b6b78d70efa1715510
-
SHA1
2de3d4c7780e12b22e4bdd7c16c86ce08f90b7ce
-
SHA256
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1
-
SHA512
de2e8044995dc723dd5b3bb61939dec4ae4cf96cf22c60398b7bd469d63853edb4e9b39fdfc8405ad4c077f5446cb9983bf9675b7d0f4282a23c59725bec602b
-
SSDEEP
768:4vw9816vhKQLroH4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oHloWMZ3izbR9Xwzz
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EEA436D-1C37-4784-BE3D-1E7D850AA803}\stubpath = "C:\\Windows\\{9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe" {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0} {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC} {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23} {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D9C7872-2449-4800-9284-0667AC43C53B} {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D9C7872-2449-4800-9284-0667AC43C53B}\stubpath = "C:\\Windows\\{7D9C7872-2449-4800-9284-0667AC43C53B}.exe" {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EEA436D-1C37-4784-BE3D-1E7D850AA803} {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FACB863-7938-4578-A207-40D577BBFA0B} 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE} {1FACB863-7938-4578-A207-40D577BBFA0B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}\stubpath = "C:\\Windows\\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe" {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}\stubpath = "C:\\Windows\\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exe" {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}\stubpath = "C:\\Windows\\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe" {1FACB863-7938-4578-A207-40D577BBFA0B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC}\stubpath = "C:\\Windows\\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe" {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}\stubpath = "C:\\Windows\\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe" {7D9C7872-2449-4800-9284-0667AC43C53B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FACB863-7938-4578-A207-40D577BBFA0B}\stubpath = "C:\\Windows\\{1FACB863-7938-4578-A207-40D577BBFA0B}.exe" 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984} {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984}\stubpath = "C:\\Windows\\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe" {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6} {7D9C7872-2449-4800-9284-0667AC43C53B}.exe -
Deletes itself 1 IoCs
pid Process 2492 cmd.exe -
Executes dropped EXE 9 IoCs
pid Process 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 1704 {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe 2996 {5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe File created C:\Windows\{7D9C7872-2449-4800-9284-0667AC43C53B}.exe {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe File created C:\Windows\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe {7D9C7872-2449-4800-9284-0667AC43C53B}.exe File created C:\Windows\{9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe File created C:\Windows\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exe {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe File created C:\Windows\{1FACB863-7938-4578-A207-40D577BBFA0B}.exe 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe File created C:\Windows\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe {1FACB863-7938-4578-A207-40D577BBFA0B}.exe File created C:\Windows\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe File created C:\Windows\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7D9C7872-2449-4800-9284-0667AC43C53B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1FACB863-7938-4578-A207-40D577BBFA0B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Token: SeIncBasePriorityPrivilege 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe Token: SeIncBasePriorityPrivilege 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe Token: SeIncBasePriorityPrivilege 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe Token: SeIncBasePriorityPrivilege 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe Token: SeIncBasePriorityPrivilege 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe Token: SeIncBasePriorityPrivilege 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe Token: SeIncBasePriorityPrivilege 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe Token: SeIncBasePriorityPrivilege 1704 {9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 1320 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 31 PID 2568 wrote to memory of 1320 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 31 PID 2568 wrote to memory of 1320 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 31 PID 2568 wrote to memory of 1320 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 31 PID 2568 wrote to memory of 2492 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 32 PID 2568 wrote to memory of 2492 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 32 PID 2568 wrote to memory of 2492 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 32 PID 2568 wrote to memory of 2492 2568 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 32 PID 1320 wrote to memory of 1192 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 33 PID 1320 wrote to memory of 1192 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 33 PID 1320 wrote to memory of 1192 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 33 PID 1320 wrote to memory of 1192 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 33 PID 1320 wrote to memory of 2188 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 34 PID 1320 wrote to memory of 2188 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 34 PID 1320 wrote to memory of 2188 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 34 PID 1320 wrote to memory of 2188 1320 {1FACB863-7938-4578-A207-40D577BBFA0B}.exe 34 PID 1192 wrote to memory of 2940 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 35 PID 1192 wrote to memory of 2940 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 35 PID 1192 wrote to memory of 2940 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 35 PID 1192 wrote to memory of 2940 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 35 PID 1192 wrote to memory of 2076 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 36 PID 1192 wrote to memory of 2076 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 36 PID 1192 wrote to memory of 2076 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 36 PID 1192 wrote to memory of 2076 1192 {DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe 36 PID 2940 wrote to memory of 2680 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 37 PID 2940 wrote to memory of 2680 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 37 PID 2940 wrote to memory of 2680 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 37 PID 2940 wrote to memory of 2680 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 37 PID 2940 wrote to memory of 2968 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 38 PID 2940 wrote to memory of 2968 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 38 PID 2940 wrote to memory of 2968 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 38 PID 2940 wrote to memory of 2968 2940 {EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe 38 PID 2680 wrote to memory of 1664 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 39 PID 2680 wrote to memory of 1664 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 39 PID 2680 wrote to memory of 1664 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 39 PID 2680 wrote to memory of 1664 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 39 PID 2680 wrote to memory of 2724 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 40 PID 2680 wrote to memory of 2724 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 40 PID 2680 wrote to memory of 2724 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 40 PID 2680 wrote to memory of 2724 2680 {10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe 40 PID 1664 wrote to memory of 1984 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 41 PID 1664 wrote to memory of 1984 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 41 PID 1664 wrote to memory of 1984 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 41 PID 1664 wrote to memory of 1984 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 41 PID 1664 wrote to memory of 1072 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 42 PID 1664 wrote to memory of 1072 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 42 PID 1664 wrote to memory of 1072 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 42 PID 1664 wrote to memory of 1072 1664 {21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe 42 PID 1984 wrote to memory of 2312 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 43 PID 1984 wrote to memory of 2312 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 43 PID 1984 wrote to memory of 2312 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 43 PID 1984 wrote to memory of 2312 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 43 PID 1984 wrote to memory of 1008 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 44 PID 1984 wrote to memory of 1008 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 44 PID 1984 wrote to memory of 1008 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 44 PID 1984 wrote to memory of 1008 1984 {7D9C7872-2449-4800-9284-0667AC43C53B}.exe 44 PID 2312 wrote to memory of 1704 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 45 PID 2312 wrote to memory of 1704 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 45 PID 2312 wrote to memory of 1704 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 45 PID 2312 wrote to memory of 1704 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 45 PID 2312 wrote to memory of 1656 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 46 PID 2312 wrote to memory of 1656 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 46 PID 2312 wrote to memory of 1656 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 46 PID 2312 wrote to memory of 1656 2312 {B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe"C:\Users\Admin\AppData\Local\Temp\949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\{1FACB863-7938-4578-A207-40D577BBFA0B}.exeC:\Windows\{1FACB863-7938-4578-A207-40D577BBFA0B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exeC:\Windows\{DA3A636B-20A8-4eb1-907D-99B1CDD00FAE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exeC:\Windows\{EBD0B0B1-1B35-460e-A7B2-6CCC71341984}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exeC:\Windows\{10CB7C3E-8338-4302-A5D1-E78D8261F5AC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exeC:\Windows\{21AF8DEC-5426-45d1-B4CD-8A1E1502AA23}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\{7D9C7872-2449-4800-9284-0667AC43C53B}.exeC:\Windows\{7D9C7872-2449-4800-9284-0667AC43C53B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exeC:\Windows\{B2B9CF2B-82D3-4a35-97FA-2EF91AA082C6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\{9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exeC:\Windows\{9EEA436D-1C37-4784-BE3D-1E7D850AA803}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1704 -
C:\Windows\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exeC:\Windows\{5729B4C6-2FC8-48dd-9BF5-0D7477CD5FA0}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EEA4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2B9C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:1656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D9C7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21AF8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10CB7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBD0B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA3A6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FACB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\949C0C~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD55f09ff398ad308209f808fc3088185f9
SHA118ae5c3144524e96131bb2b28fe228c1bbf9c861
SHA256386319227847c8a4fb83e4c0984ba24c25e517bdba6eead6ee6b2b69ba765115
SHA5128158651bdbc8b5464a893f8205c03ced20ab8fd19b363d5ba6e682e37732d2bf86d8fcd769e97c49b17fe503347bb28d2946ce9e2dbb2c1764967c1c820830ce
-
Filesize
79KB
MD57d167ca937c83399e9f24227df842575
SHA10cfc6f33ca8f66fa150a5ad6621d8fde12849401
SHA256a73bae9187db8225ff9e7a18a4c59931337e25ef19d6a7693b3fd52c03a9ac74
SHA512b3d2744e3a8541f3d96e2c8a958db2c5e546c20f460092340b81b08397cc196d35172ce2a3a2f52c2ff0e355c9829117703c6f8c81f42a20d4ac3c1874433a0d
-
Filesize
79KB
MD524e732ab254fc3634d1a695fc9cf11ab
SHA1776bd040448147d6ae89119c8717edad109411ec
SHA256e653f43139313e3f3ea7f4dcef4c63806de7240442daea83de8e1e2109ad6494
SHA512ecc63b1dbb43c68781c421622660de9d3b1b7b4b04b5b0113623bf58ede5c772e5aaff57686005ed0ba6229c196a97b7a5126544f721e3e3ec22d4b096523931
-
Filesize
79KB
MD5de46c2c11a2c92eaf9ed8ca84afdfc1c
SHA13d7d753e71ef62d639ef215743939770978097f1
SHA256266b544f327c1e2714e996c214799d5350b07e3aa376f0ec12cab04c4c19d072
SHA512611e27d3cc61de5c900476714535932e6f1a61f6920013e36d8498abc74e1749a4ff5c87723dc6676c2b4d491cfd80e17faa5ec138dc3ad30a82d1b09d8c70f7
-
Filesize
79KB
MD512e1a9723c415c7c111be638b4e6a3d6
SHA18863bcc4f9de0584d54d1e68455c1489df3562f8
SHA256e8466d3d2f1ea260846f2bfe0a2f2f8958aa0d44e3972bd5765c01051ae711b1
SHA512df27cab1a1527948e63c727a6aced7fed0716aa32621ec8e3907f8b29cdeaf7e65f88c3674867016164b312cc55f453942db5918b2571590825e221fa3200a02
-
Filesize
79KB
MD5971947b5d89e3dd32e0c5ed60560108f
SHA191186c7d8e3faf69d8e978c9fb4a7c6bdda5f458
SHA2564f6ec7ed3a0133d43699c59a226aba8c1e170437835d59bc7a5b38c80afa4714
SHA5126cc2e558983a00045b3550ed6c81db5542198b5038881eeb395ca491497d07dd31a9265335463af540a57037f39d3eaab0af780893ef77a1a4a076a8c28fd4fb
-
Filesize
79KB
MD5d59d5eb22c4f5b400da03f17fc80e527
SHA132f55855cf56ee69c26188994d06c083d2ee39fa
SHA256699c3263487a106f9fe20cff83cec8db782639a59b787fc220c54d8724b39a52
SHA5125b23136257d406c53e0af71f4fba08a9dd5a5a438f857f9e14e5b996a8a5c9a6ac2b8fa6d1d162484d818067f24daa3839b5b767bd7bd1f06b157fc0ee57495a
-
Filesize
79KB
MD5b5fd07dc68f84219ccec7849720a3c45
SHA18df5ad377f66a674fa8718f2c130fc9506c8e886
SHA25624fe6d92484658adb07c435f7934f7d7e1dfe44f135fd0fc2917920870413ba0
SHA51219f93013ba56d6d14df23c660d54e1f378b09146addd7d44d0b2117a9a0c787dbcff1f43a24270f09069d909e4044bc51daf8c91a331b8cf6409c7271477eaed
-
Filesize
79KB
MD525ff870c03f10fa00cbcfd0cae85b34e
SHA1f5d408dacc708b0bf93fc1e66fa96082c758dd8b
SHA25632a25b86ed8983da1484787893ea3fcd95b2996de48fdbb92d9b68acc5c151cb
SHA5123d5ff02f69b2cc58c3dc42066ae715619510773a4fa2ec10c47720600aebaebc739be171bbd25723a9418dde3639092bda95aec533ec4c3d4e07909e67eae2c5