Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe
Resource
win10v2004-20241007-en
General
-
Target
aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe
-
Size
79KB
-
MD5
d47cd63e85931c9c07f9f7a9526c5ef9
-
SHA1
7b828535c235871a9cde0ddb8bac6be88b0a9baa
-
SHA256
4f4d9cf53a05df7f2a0eb520737b83586ea875090d2eceb7fbdfe969b871fc9d
-
SHA512
596dfbd1352b3a5fe0821d7e6024c3b28c18233bdd1a0af257f731463f9b27a7a9c56cb13e6913ce2352bd4ad9dc79d271d7707eb9b97a6ba5a914f896223825
-
SSDEEP
768:4vw9816vhKQLroe4/wQpWMZ3XOQ69zbjlAAX5e9zg:wEGh0oeloWMZ3izbR9Xwzg
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}\stubpath = "C:\\Windows\\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe" {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D57B644B-075B-4e6d-A86D-297BCD625BA0}\stubpath = "C:\\Windows\\{D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe" {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}\stubpath = "C:\\Windows\\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe" {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047} aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A23CC6E-4004-4790-88CE-AA3047AD24D7} {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A23CC6E-4004-4790-88CE-AA3047AD24D7}\stubpath = "C:\\Windows\\{1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe" {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50B4F8D7-6196-4d0c-909D-3E50D3C54834} {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5} {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93750D06-50CE-4665-8383-FCAE56E6DDAC}\stubpath = "C:\\Windows\\{93750D06-50CE-4665-8383-FCAE56E6DDAC}.exe" {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D57B644B-075B-4e6d-A86D-297BCD625BA0} {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037} {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50B4F8D7-6196-4d0c-909D-3E50D3C54834}\stubpath = "C:\\Windows\\{50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe" {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39} {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}\stubpath = "C:\\Windows\\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe" aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94} {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39}\stubpath = "C:\\Windows\\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe" {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5}\stubpath = "C:\\Windows\\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe" {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93750D06-50CE-4665-8383-FCAE56E6DDAC} {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe -
Deletes itself 1 IoCs
pid Process 2380 cmd.exe -
Executes dropped EXE 9 IoCs
pid Process 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 1420 {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe 2952 {93750D06-50CE-4665-8383-FCAE56E6DDAC}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe File created C:\Windows\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe File created C:\Windows\{93750D06-50CE-4665-8383-FCAE56E6DDAC}.exe {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe File created C:\Windows\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe File created C:\Windows\{D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe File created C:\Windows\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe File created C:\Windows\{50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe File created C:\Windows\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe File created C:\Windows\{1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {93750D06-50CE-4665-8383-FCAE56E6DDAC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe Token: SeIncBasePriorityPrivilege 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe Token: SeIncBasePriorityPrivilege 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe Token: SeIncBasePriorityPrivilege 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe Token: SeIncBasePriorityPrivilege 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe Token: SeIncBasePriorityPrivilege 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe Token: SeIncBasePriorityPrivilege 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe Token: SeIncBasePriorityPrivilege 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe Token: SeIncBasePriorityPrivilege 1420 {F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2956 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 30 PID 2516 wrote to memory of 2956 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 30 PID 2516 wrote to memory of 2956 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 30 PID 2516 wrote to memory of 2956 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 30 PID 2516 wrote to memory of 2380 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 31 PID 2516 wrote to memory of 2380 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 31 PID 2516 wrote to memory of 2380 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 31 PID 2516 wrote to memory of 2380 2516 aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe 31 PID 2956 wrote to memory of 2856 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 33 PID 2956 wrote to memory of 2856 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 33 PID 2956 wrote to memory of 2856 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 33 PID 2956 wrote to memory of 2856 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 33 PID 2956 wrote to memory of 2720 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 34 PID 2956 wrote to memory of 2720 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 34 PID 2956 wrote to memory of 2720 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 34 PID 2956 wrote to memory of 2720 2956 {BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe 34 PID 2856 wrote to memory of 2844 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 35 PID 2856 wrote to memory of 2844 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 35 PID 2856 wrote to memory of 2844 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 35 PID 2856 wrote to memory of 2844 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 35 PID 2856 wrote to memory of 2600 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 36 PID 2856 wrote to memory of 2600 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 36 PID 2856 wrote to memory of 2600 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 36 PID 2856 wrote to memory of 2600 2856 {D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe 36 PID 2844 wrote to memory of 2572 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 37 PID 2844 wrote to memory of 2572 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 37 PID 2844 wrote to memory of 2572 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 37 PID 2844 wrote to memory of 2572 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 37 PID 2844 wrote to memory of 2640 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 38 PID 2844 wrote to memory of 2640 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 38 PID 2844 wrote to memory of 2640 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 38 PID 2844 wrote to memory of 2640 2844 {1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe 38 PID 2572 wrote to memory of 2536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 39 PID 2572 wrote to memory of 2536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 39 PID 2572 wrote to memory of 2536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 39 PID 2572 wrote to memory of 2536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 39 PID 2572 wrote to memory of 1536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 40 PID 2572 wrote to memory of 1536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 40 PID 2572 wrote to memory of 1536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 40 PID 2572 wrote to memory of 1536 2572 {D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe 40 PID 2536 wrote to memory of 348 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 41 PID 2536 wrote to memory of 348 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 41 PID 2536 wrote to memory of 348 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 41 PID 2536 wrote to memory of 348 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 41 PID 2536 wrote to memory of 2792 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 42 PID 2536 wrote to memory of 2792 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 42 PID 2536 wrote to memory of 2792 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 42 PID 2536 wrote to memory of 2792 2536 {D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe 42 PID 348 wrote to memory of 2328 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 43 PID 348 wrote to memory of 2328 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 43 PID 348 wrote to memory of 2328 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 43 PID 348 wrote to memory of 2328 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 43 PID 348 wrote to memory of 1624 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 44 PID 348 wrote to memory of 1624 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 44 PID 348 wrote to memory of 1624 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 44 PID 348 wrote to memory of 1624 348 {50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe 44 PID 2328 wrote to memory of 1420 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 45 PID 2328 wrote to memory of 1420 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 45 PID 2328 wrote to memory of 1420 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 45 PID 2328 wrote to memory of 1420 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 45 PID 2328 wrote to memory of 1248 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 46 PID 2328 wrote to memory of 1248 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 46 PID 2328 wrote to memory of 1248 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 46 PID 2328 wrote to memory of 1248 2328 {25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe"C:\Users\Admin\AppData\Local\Temp\aae0b153216e452853ef124a4b3f1657c1194d5702b946bd8de72f17437bd125N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exeC:\Windows\{BEF5AAC4-BD88-4969-A0C6-4F1D19F84047}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exeC:\Windows\{D7C6E14B-3D88-4c7f-A9C0-9BFD45A7AA94}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\{1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exeC:\Windows\{1A23CC6E-4004-4790-88CE-AA3047AD24D7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\{D57B644B-075B-4e6d-A86D-297BCD625BA0}.exeC:\Windows\{D57B644B-075B-4e6d-A86D-297BCD625BA0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exeC:\Windows\{D05A1EBE-7C3A-42ff-BBDB-CB89EE4F8037}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\{50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exeC:\Windows\{50B4F8D7-6196-4d0c-909D-3E50D3C54834}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exeC:\Windows\{25F6C9EF-7ECB-4cee-B1CF-662F10101E39}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exeC:\Windows\{F20DDF55-CB9C-458d-9291-9863EAB3F0B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\{93750D06-50CE-4665-8383-FCAE56E6DDAC}.exeC:\Windows\{93750D06-50CE-4665-8383-FCAE56E6DDAC}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F20DD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25F6C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50B4F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D05A1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D57B6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:1536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A23C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7C6E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEF5A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\AAE0B1~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5c70fde1c1574978736f7498bf4fea0d1
SHA158dbf70743c74bed7b6e3c82b60a8c06f5163507
SHA256ca49741fccd80f07106bbc992e5f6ece17ff6fbecee6c85567c2a746c39810aa
SHA512f7e03d3addd59b32ff9b98b7521febb9e6c2b29f81a3738d1f44851c2c1b37f86e83afacee7437b266156fe51b0504328e59d68d31c5cf13c47f92850e2a3e6b
-
Filesize
79KB
MD5fa93b4846d68528eabc40ad11f58cee8
SHA17e4e686e210ab2849212a6e7827311546c4ce895
SHA2566311161dba08bdae6c4e9231d437dce5a3432e94a95538f8e06493a7405ebf22
SHA512934c68b1a62538b9c850b136da11f2125d89d288caae5f2e5ea6c8df3f5ff1d374c87562369174b5dc5bec070a94d317e71b15e65f3fe77071c77b251b44177a
-
Filesize
79KB
MD5fde9e7a0a210fbe613555f8b1448b716
SHA1c288d302b33da89b7ce1e238171f760d0de335fa
SHA256afdf8a41bc6bebf0102c884c698c3c3b26a3cf04f658d340a64d1068a78e5a1f
SHA512e91bbff83f09ea2b75a3f9d4e11be50cd75a9582efbaa8da81e232e466101e09c66891a2056f95b89bd02fb61aab3e813ccff4b2c0153796c91d9a607784ee5f
-
Filesize
79KB
MD56f7d4d91ba67164cf496ecf3368ae678
SHA1aca6b11174cae0091ac61104c854f25c107a2a56
SHA256f1670ba78275459d7019c960d32f57250b729328c18255c55c357814769074d4
SHA512e72b5517ae8f8feca8a461a5f67a817b0020b540bb4d86993c603f3fe9d96e963062bc63aabc648ca497aa2cc16043404dae45c936b8760e4ad06917ab3d94a5
-
Filesize
79KB
MD5db4a64a7c61f7e9063dd8fbc2da44f7e
SHA194cb313c00a8b1f79acf30581b29c7fdcb309a21
SHA2569b5306440ae97a56b9c9d0d59270a3c87576729a8fe111df9632e2b24a2d5e37
SHA512be477969350816be00790c6bc62ff9fd091827535f31ee04434fbc9809664e03d377d379a1e72e78d41da0e5b14b309bc36d302c438c593c3efb8c83ee878c10
-
Filesize
79KB
MD5703fc283c0621abd0871e4982a008d74
SHA137b1f85192978210f861b3adc025b34c4bde67c8
SHA256205b8753fc35516b4e938f26004c7da2646abe5c0a0453ed82a3c00ff4616371
SHA5122c533002c1efb43f86b93eab2d7a65931a58acadad208cd6c4abcb45fbdfec450c8bd3bf218790f7211e1ee485a554f8df9173ac65ff859346a1232808622339
-
Filesize
79KB
MD53db51fa482f8aad0d0a7a2c494ab9587
SHA1cfb1772f5afb9d9e1f900f0d8c7961c5da659a6c
SHA25665365886a6c8e125d6cc4a8d80ed0743082cb3e5422ec9898c322b684e5ff765
SHA512f07f397979b25bd35c232fd765a0d8bd8136f1a0ee25a34eb643b9e3bebace71d520f86dd7af198b0b75f74a064a87f92417282e10b035815af6b826ebe63a2a
-
Filesize
79KB
MD5726d85c74b266b18630dd35343aa7a32
SHA122bbcad612ad51c26a36114d8429320c03bd906d
SHA256e159f1d4dd980bb303d21156ead2b048bacb187e1cc4b38401a297c1303c3a3e
SHA51230311ee7a16d56a1b03e1894c6a91253d80ac749def5e867e0d3c8404825a5f2922d0a420c406917a432a7b0b26355f5cc5cab08df15c111065a76d64106d716
-
Filesize
79KB
MD5e31768f51fd04c824a945366687049fe
SHA1a8005e1484ac949f12956d0fd75133163c9f69bf
SHA256a70918d39c65595947ea7aea10e11dae73f5b28cbbbba5972cd0a45d3e994d5d
SHA512a4811657e888a89399d4a57fe7176c1161f98785bd1565b3438f551a9742a947b6044da1f0c51ab00947bf7443788d679d0ac76c60bcd4db3982d32085169ba3