Analysis
-
max time kernel
118s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
Resource
win10v2004-20241007-en
General
-
Target
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe
-
Size
79KB
-
MD5
ead7f6b3af34c9b6b78d70efa1715510
-
SHA1
2de3d4c7780e12b22e4bdd7c16c86ce08f90b7ce
-
SHA256
949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1
-
SHA512
de2e8044995dc723dd5b3bb61939dec4ae4cf96cf22c60398b7bd469d63853edb4e9b39fdfc8405ad4c077f5446cb9983bf9675b7d0f4282a23c59725bec602b
-
SSDEEP
768:4vw9816vhKQLroH4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oHloWMZ3izbR9Xwzz
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461} {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1}\stubpath = "C:\\Windows\\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe" {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E100349-3C1F-4193-B8AE-C0D22140D495} {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E100349-3C1F-4193-B8AE-C0D22140D495}\stubpath = "C:\\Windows\\{6E100349-3C1F-4193-B8AE-C0D22140D495}.exe" {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA} 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1} {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C39F04CD-D3E1-4081-881E-229D7855B7C4}\stubpath = "C:\\Windows\\{C39F04CD-D3E1-4081-881E-229D7855B7C4}.exe" {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28FF102C-F33C-4164-A5E9-E15F011D4733} {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}\stubpath = "C:\\Windows\\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe" {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28FF102C-F33C-4164-A5E9-E15F011D4733}\stubpath = "C:\\Windows\\{28FF102C-F33C-4164-A5E9-E15F011D4733}.exe" {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DD84207-0E2B-4fd3-9DD8-5E644223B967} {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}\stubpath = "C:\\Windows\\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe" 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC0C7982-EC53-4298-A8F8-938D6449DE31}\stubpath = "C:\\Windows\\{FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe" {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A} {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}\stubpath = "C:\\Windows\\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe" {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DD84207-0E2B-4fd3-9DD8-5E644223B967}\stubpath = "C:\\Windows\\{9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe" {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C39F04CD-D3E1-4081-881E-229D7855B7C4} {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC0C7982-EC53-4298-A8F8-938D6449DE31} {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe -
Executes dropped EXE 9 IoCs
pid Process 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 1204 {C39F04CD-D3E1-4081-881E-229D7855B7C4}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{28FF102C-F33C-4164-A5E9-E15F011D4733}.exe {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe File created C:\Windows\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe File created C:\Windows\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe File created C:\Windows\{FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe File created C:\Windows\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe File created C:\Windows\{6E100349-3C1F-4193-B8AE-C0D22140D495}.exe {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe File created C:\Windows\{9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe File created C:\Windows\{C39F04CD-D3E1-4081-881E-229D7855B7C4}.exe {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe File created C:\Windows\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C39F04CD-D3E1-4081-881E-229D7855B7C4}.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe Token: SeIncBasePriorityPrivilege 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe Token: SeIncBasePriorityPrivilege 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe Token: SeIncBasePriorityPrivilege 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe Token: SeIncBasePriorityPrivilege 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe Token: SeIncBasePriorityPrivilege 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe Token: SeIncBasePriorityPrivilege 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe Token: SeIncBasePriorityPrivilege 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe Token: SeIncBasePriorityPrivilege 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2096 wrote to memory of 4748 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 100 PID 2096 wrote to memory of 4748 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 100 PID 2096 wrote to memory of 4748 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 100 PID 2096 wrote to memory of 4848 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 101 PID 2096 wrote to memory of 4848 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 101 PID 2096 wrote to memory of 4848 2096 949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe 101 PID 4748 wrote to memory of 2084 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 102 PID 4748 wrote to memory of 2084 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 102 PID 4748 wrote to memory of 2084 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 102 PID 4748 wrote to memory of 3484 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 103 PID 4748 wrote to memory of 3484 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 103 PID 4748 wrote to memory of 3484 4748 {B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe 103 PID 2084 wrote to memory of 1608 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 107 PID 2084 wrote to memory of 1608 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 107 PID 2084 wrote to memory of 1608 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 107 PID 2084 wrote to memory of 1512 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 108 PID 2084 wrote to memory of 1512 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 108 PID 2084 wrote to memory of 1512 2084 {EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe 108 PID 1608 wrote to memory of 1316 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 109 PID 1608 wrote to memory of 1316 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 109 PID 1608 wrote to memory of 1316 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 109 PID 1608 wrote to memory of 4812 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 110 PID 1608 wrote to memory of 4812 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 110 PID 1608 wrote to memory of 4812 1608 {28FF102C-F33C-4164-A5E9-E15F011D4733}.exe 110 PID 1316 wrote to memory of 3600 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 112 PID 1316 wrote to memory of 3600 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 112 PID 1316 wrote to memory of 3600 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 112 PID 1316 wrote to memory of 740 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 113 PID 1316 wrote to memory of 740 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 113 PID 1316 wrote to memory of 740 1316 {FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe 113 PID 3600 wrote to memory of 4476 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 114 PID 3600 wrote to memory of 4476 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 114 PID 3600 wrote to memory of 4476 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 114 PID 3600 wrote to memory of 4884 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 115 PID 3600 wrote to memory of 4884 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 115 PID 3600 wrote to memory of 4884 3600 {B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe 115 PID 4476 wrote to memory of 4824 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 116 PID 4476 wrote to memory of 4824 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 116 PID 4476 wrote to memory of 4824 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 116 PID 4476 wrote to memory of 4772 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 117 PID 4476 wrote to memory of 4772 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 117 PID 4476 wrote to memory of 4772 4476 {4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe 117 PID 4824 wrote to memory of 2352 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 118 PID 4824 wrote to memory of 2352 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 118 PID 4824 wrote to memory of 2352 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 118 PID 4824 wrote to memory of 2628 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 119 PID 4824 wrote to memory of 2628 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 119 PID 4824 wrote to memory of 2628 4824 {6E100349-3C1F-4193-B8AE-C0D22140D495}.exe 119 PID 2352 wrote to memory of 1204 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 120 PID 2352 wrote to memory of 1204 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 120 PID 2352 wrote to memory of 1204 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 120 PID 2352 wrote to memory of 2224 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 121 PID 2352 wrote to memory of 2224 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 121 PID 2352 wrote to memory of 2224 2352 {9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe"C:\Users\Admin\AppData\Local\Temp\949c0c15bdec194fd79d3e52cfccba7d89dec8951597b762b41e7597faf195b1N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exeC:\Windows\{B94AF03E-3CEA-48ba-8D69-9071EF2DCBAA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exeC:\Windows\{EFD8A4BF-8AF5-44a6-95E4-993E8BC29461}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\{28FF102C-F33C-4164-A5E9-E15F011D4733}.exeC:\Windows\{28FF102C-F33C-4164-A5E9-E15F011D4733}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\{FC0C7982-EC53-4298-A8F8-938D6449DE31}.exeC:\Windows\{FC0C7982-EC53-4298-A8F8-938D6449DE31}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exeC:\Windows\{B2120055-8AAE-412e-A3A5-A8EDBEF014E1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exeC:\Windows\{4F0FC7F7-FF52-4235-8F25-5DD5B2F8AC8A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\{6E100349-3C1F-4193-B8AE-C0D22140D495}.exeC:\Windows\{6E100349-3C1F-4193-B8AE-C0D22140D495}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\{9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exeC:\Windows\{9DD84207-0E2B-4fd3-9DD8-5E644223B967}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\{C39F04CD-D3E1-4081-881E-229D7855B7C4}.exeC:\Windows\{C39F04CD-D3E1-4081-881E-229D7855B7C4}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DD84~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E100~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F0FC~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2120~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC0C7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28FF1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFD8A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B94AF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\949C0C~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:4848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD50bb411d3e5241dbca8f7b297eeca16a3
SHA1a52c2b4d22c1558176d793d9e56e6a3f0c28898c
SHA256be5050700820d093a0de33bbc75c5c541e7c80d5f4a03715666a306c060eb3e5
SHA512e738aeac9dbf205d26cb0b4ab7713516ad8e2a09c13ee24700548dccf133c87e8dae6c7030985242c9d4cc0d91b3362871e16f8ab424d9bab8593fac58a1c115
-
Filesize
79KB
MD59477b09b62eb9d1b6a5353e82eafc7fd
SHA1dca510b70731a3f6a1ade2bc2bb076fa15dfcbfb
SHA256a4026704f4cf12b63a9970cc34cf335a35f33df9f49d278f7db3c8d12acddfa2
SHA512908bf4accff99c3b67d641409be3e2b5bbbd1aad55678bc123ecbc5f9765d654bbaeee19edfbbce98ce8ccb54a917b451c9c117a339931d0e61cbf447b647450
-
Filesize
79KB
MD51e6cbc85f9bd2d1335142b913c58c465
SHA123f6b6e073cd196a7abd674ade196d256e1eb524
SHA25690bdc1ecea2636d25391894026b23dc44727c9c9aa830ade7a846fc96ead5b31
SHA51237972329c0966e1222096de3521f7a274decb3c4b62f25e5692e24dae2b65dc8537cb35490ca839666475a196f8f90202262a65cbef10f1ecca26043e4195ac6
-
Filesize
79KB
MD5952dd487f01bda3df769ae7d5ffd4792
SHA1ff2739aa23c6ddc5e38b15aab2f1d2fa3a42e373
SHA2568841b4270f5abba709637d89ec9136316668ed371165919f4573ff03f269e537
SHA51274cf66ef3501065f57bcb650de0e827e150de4832d241d0af19c0c4ec9fc6bebec7c6f8d3796c2bf9bf6de55b1045a039e872bc84d43f7cf28d86e00c71b0b71
-
Filesize
79KB
MD5b714c4ce3a163b18b19b647c50fcb12e
SHA17dae29dd7e5a95864a0903772ce79920e6c79ed6
SHA256b898399cd1a54f1fad4c5327fff4d0801204fa4c6f6135860e9b3a354b3d24e7
SHA5123b01ebddb544b3dd1575fb88332993535f060b37a3bfc663b68cf712c405ae30202cd43e2a522935bb034119ab5488857bb87b323a0ebe9754bb0f5262370741
-
Filesize
79KB
MD5fe10013d4198e03f219656f1ca05060e
SHA1db7f0444388a5e9ab8802c4571208b3fcc884533
SHA2565c12700260c798fb43a5837766dc5fca369ab89d367c64cdef66f51e69990e4a
SHA5125ace0b5b5fbeaded844d7f62ccaf3211f7390451a6401e2c2ed1f623b7d8a585ad750b053112e0231f51f0fe1bb65ef45131f8dec360ad5c57c18ba20d7c9f1a
-
Filesize
79KB
MD52ca8579146685025bfed6d917ecc06ab
SHA1cb914cdca1bdd91df3636ed9338a8016f311eb7d
SHA2565d4de2945c9d3779161df622d0b62cac93ec3b125aa1cf7934d12c4482b1d9b2
SHA5127901d7b20265887cd1a772090b473717da408187f92b72ff552780f2cc9d65bc0b35fcf5900db73e17811bb1c954cb2f422faf9d1c0c50e87dc8998cf0cde94d
-
Filesize
79KB
MD55293a1b3b4e88a955c2215b0e3d9268a
SHA137c4fc012ff8d84bd535aea2dcf6b0178d3534c3
SHA256566326b4f311ac037b3696f6529aa48accaa0dbfd4e50bd6bd6389af05a99d85
SHA512fffce508961aec0b125260ad7348c8e828695751c93537a2e0116c9ff7e9dcb8bb62d561776f8c8496e74c2441c105064cdd8c63960f8ff8d94e0dd65fdb4b6d
-
Filesize
79KB
MD52ea1999d16dba4c1acbc007ac726d1eb
SHA1df4beb8af8974610dfce6ad69f1c4195332bda5f
SHA2560a41b28d089bf9ae1036cb33cd48e815d584fbd457c9278b1c838639d73269fb
SHA5129a6b8f6e0b43a3a3da6b4e0aee027e5c32e7eefe2d44c464fde33bbfa3dd925db50fee228bd7a43e9e2196a36cb5a4ed414c6e37ad19d29a1594fe1ff022320f