Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
Resource
win10v2004-20241007-en
General
-
Target
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
-
Size
90KB
-
MD5
c7c1619de6fffe00344fd1cf305bf90f
-
SHA1
71dba18f0795099f0ce43f77f38e1c22aff18b8b
-
SHA256
1132de8a4f69e915a2a8a55ff1468a0676c89581b5513847febb35fc4c6ee730
-
SHA512
27de386433284d465977c6a0e449a900a96d08ed532a2978c652b2ddf841e55f99c75ed46d99d2c99b3e5170fe331072d15f7d5a6da2f0641febace1edaaafba
-
SSDEEP
768:Qvw9816vhKQLroH4/wQRNrfrunMxVFA3b7gl4:YEGh0oHl2unMxVS3HgG
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C517047-EB52-445a-9C89-89E52197860B} {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C517047-EB52-445a-9C89-89E52197860B}\stubpath = "C:\\Windows\\{7C517047-EB52-445a-9C89-89E52197860B}.exe" {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24671832-D1E0-4206-83E5-4C41DCECA58B} {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA} {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA}\stubpath = "C:\\Windows\\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exe" {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F40B7CBD-8DD1-4d9a-A441-0A9082614373} 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F40B7CBD-8DD1-4d9a-A441-0A9082614373}\stubpath = "C:\\Windows\\{F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe" 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6} {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{402FA2F3-38D5-467a-B038-56CED5E17AA1}\stubpath = "C:\\Windows\\{402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe" {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58}\stubpath = "C:\\Windows\\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe" {7C517047-EB52-445a-9C89-89E52197860B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49989BCB-BCFB-46ce-B02D-333FE534EB2F} {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FDA8D5E-4749-4be3-901E-0004F863014B}\stubpath = "C:\\Windows\\{5FDA8D5E-4749-4be3-901E-0004F863014B}.exe" {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{402FA2F3-38D5-467a-B038-56CED5E17AA1} {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58} {7C517047-EB52-445a-9C89-89E52197860B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}\stubpath = "C:\\Windows\\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe" {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49989BCB-BCFB-46ce-B02D-333FE534EB2F}\stubpath = "C:\\Windows\\{49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe" {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24671832-D1E0-4206-83E5-4C41DCECA58B}\stubpath = "C:\\Windows\\{24671832-D1E0-4206-83E5-4C41DCECA58B}.exe" {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FDA8D5E-4749-4be3-901E-0004F863014B} {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe -
Deletes itself 1 IoCs
pid Process 2640 cmd.exe -
Executes dropped EXE 9 IoCs
pid Process 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 1456 {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe 2432 {CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe File created C:\Windows\{7C517047-EB52-445a-9C89-89E52197860B}.exe {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe File created C:\Windows\{49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe File created C:\Windows\{F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe File created C:\Windows\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe {7C517047-EB52-445a-9C89-89E52197860B}.exe File created C:\Windows\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe File created C:\Windows\{24671832-D1E0-4206-83E5-4C41DCECA58B}.exe {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe File created C:\Windows\{5FDA8D5E-4749-4be3-901E-0004F863014B}.exe {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe File created C:\Windows\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exe {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {7C517047-EB52-445a-9C89-89E52197860B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Token: SeIncBasePriorityPrivilege 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe Token: SeIncBasePriorityPrivilege 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe Token: SeIncBasePriorityPrivilege 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe Token: SeIncBasePriorityPrivilege 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe Token: SeIncBasePriorityPrivilege 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe Token: SeIncBasePriorityPrivilege 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe Token: SeIncBasePriorityPrivilege 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe Token: SeIncBasePriorityPrivilege 1456 {5FDA8D5E-4749-4be3-901E-0004F863014B}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1048 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 31 PID 2380 wrote to memory of 1048 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 31 PID 2380 wrote to memory of 1048 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 31 PID 2380 wrote to memory of 1048 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 31 PID 2380 wrote to memory of 2640 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 32 PID 2380 wrote to memory of 2640 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 32 PID 2380 wrote to memory of 2640 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 32 PID 2380 wrote to memory of 2640 2380 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 32 PID 1048 wrote to memory of 2696 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 33 PID 1048 wrote to memory of 2696 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 33 PID 1048 wrote to memory of 2696 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 33 PID 1048 wrote to memory of 2696 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 33 PID 1048 wrote to memory of 2804 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 34 PID 1048 wrote to memory of 2804 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 34 PID 1048 wrote to memory of 2804 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 34 PID 1048 wrote to memory of 2804 1048 {F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe 34 PID 2696 wrote to memory of 2872 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 35 PID 2696 wrote to memory of 2872 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 35 PID 2696 wrote to memory of 2872 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 35 PID 2696 wrote to memory of 2872 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 35 PID 2696 wrote to memory of 2672 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 36 PID 2696 wrote to memory of 2672 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 36 PID 2696 wrote to memory of 2672 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 36 PID 2696 wrote to memory of 2672 2696 {402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe 36 PID 2872 wrote to memory of 2792 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 37 PID 2872 wrote to memory of 2792 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 37 PID 2872 wrote to memory of 2792 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 37 PID 2872 wrote to memory of 2792 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 37 PID 2872 wrote to memory of 2668 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 38 PID 2872 wrote to memory of 2668 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 38 PID 2872 wrote to memory of 2668 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 38 PID 2872 wrote to memory of 2668 2872 {7C517047-EB52-445a-9C89-89E52197860B}.exe 38 PID 2792 wrote to memory of 2468 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 39 PID 2792 wrote to memory of 2468 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 39 PID 2792 wrote to memory of 2468 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 39 PID 2792 wrote to memory of 2468 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 39 PID 2792 wrote to memory of 2600 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 40 PID 2792 wrote to memory of 2600 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 40 PID 2792 wrote to memory of 2600 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 40 PID 2792 wrote to memory of 2600 2792 {B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe 40 PID 2468 wrote to memory of 1740 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 41 PID 2468 wrote to memory of 1740 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 41 PID 2468 wrote to memory of 1740 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 41 PID 2468 wrote to memory of 1740 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 41 PID 2468 wrote to memory of 2100 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 42 PID 2468 wrote to memory of 2100 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 42 PID 2468 wrote to memory of 2100 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 42 PID 2468 wrote to memory of 2100 2468 {9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe 42 PID 1740 wrote to memory of 1240 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 43 PID 1740 wrote to memory of 1240 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 43 PID 1740 wrote to memory of 1240 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 43 PID 1740 wrote to memory of 1240 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 43 PID 1740 wrote to memory of 2028 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 44 PID 1740 wrote to memory of 2028 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 44 PID 1740 wrote to memory of 2028 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 44 PID 1740 wrote to memory of 2028 1740 {49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe 44 PID 1240 wrote to memory of 1456 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 45 PID 1240 wrote to memory of 1456 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 45 PID 1240 wrote to memory of 1456 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 45 PID 1240 wrote to memory of 1456 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 45 PID 1240 wrote to memory of 1612 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 46 PID 1240 wrote to memory of 1612 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 46 PID 1240 wrote to memory of 1612 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 46 PID 1240 wrote to memory of 1612 1240 {24671832-D1E0-4206-83E5-4C41DCECA58B}.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe"C:\Users\Admin\AppData\Local\Temp\449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\{F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exeC:\Windows\{F40B7CBD-8DD1-4d9a-A441-0A9082614373}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\{402FA2F3-38D5-467a-B038-56CED5E17AA1}.exeC:\Windows\{402FA2F3-38D5-467a-B038-56CED5E17AA1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\{7C517047-EB52-445a-9C89-89E52197860B}.exeC:\Windows\{7C517047-EB52-445a-9C89-89E52197860B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exeC:\Windows\{B40E004E-F3DE-4183-8583-6FCF4AE1CA58}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exeC:\Windows\{9FBDBA36-C45C-4519-8B9F-0C2C9DC437E6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\{49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exeC:\Windows\{49989BCB-BCFB-46ce-B02D-333FE534EB2F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\{24671832-D1E0-4206-83E5-4C41DCECA58B}.exeC:\Windows\{24671832-D1E0-4206-83E5-4C41DCECA58B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\{5FDA8D5E-4749-4be3-901E-0004F863014B}.exeC:\Windows\{5FDA8D5E-4749-4be3-901E-0004F863014B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exeC:\Windows\{CC47532B-3180-46f2-ADA8-BDD03C5A31FA}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FDA8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24671~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49989~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FBDB~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B40E0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C517~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{402FA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F40B7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\449984~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5c7e3be925eaea78d499d6f0c78a0bfa7
SHA1b1c98dbd6eadf956ebf23b8a7aa9f4a9bc58cade
SHA256fc43ed26187a0c4aafc4187846da4dc06de7a7e3eb3221bd17aa60731b398d58
SHA5120d6ec1e83f8f7fd9feee40deab8e3750d7cc96d62cbed6bde59223280b92f00424648a8e56612d52b45ef9ae7159904fd816c76eedc253c527d54d095f735937
-
Filesize
90KB
MD53db363094444b957ae2390ba77714294
SHA1c32845c37edace4cd5c23909848079ea68338f4d
SHA256687303dad969280b55e5b15e612fa858f3a21cb996e07b1fdedb27d967010d0e
SHA512e1728536edf31b41fad9212f7b39a818d7cac1b21e83f68f68d2b10a8a7bca32a689251b8e98e164b1bb7a71516b3bf8ae2dc3c1d934c52ccb31b40db1d931f8
-
Filesize
90KB
MD5237987f5477df6817a726c558d4d9808
SHA16a934def7d5cd1222b0c7038f7c751177b12a67c
SHA2562c2a15bdddedc71658f33c8b1dd11473e9b037050c03a079e9d0fbb90815df0d
SHA512e63be8cb5da68e76b3a883a498bb8714246c0b5493950c2d302f385ef10d6709c12908563ee2424b27ad9d5d6c900a67acd46e030a941cf22ae84168af3f7525
-
Filesize
90KB
MD58f28bb3f6bc96da8e9f2089522ded173
SHA1c27cb85ac4c3bb6f31ae64ed2202596920fa9a49
SHA2565261c7e066a6d2f68633568eaaea14bc89dfa7ba5bebee213f354a414374cda4
SHA512e374841b0e4a6cb345598f331fdaef07091dfd9caeaf4f8aa412385e5f2ea2a9e12ce3b8d6a027050f10184b4aa1ed7c21eb286b72ccbdd03a2846686ae7b620
-
Filesize
90KB
MD52f8f22c0a36302d9019f9d38bd783f3a
SHA1b207e0a4ae4bad92209d1aae26e3dc785828ecf7
SHA2565da96a342a1eca174981e5cd2aa900b62a242d5fda6fde6b964a2917ee5865e6
SHA512af167ccf911c08e6d650703cf0f9b2ffc33319630205ef5825edb2c3d485b459f331b297a9c04aae615ac651c707e69ad32d20626e490069fd8dae9a59280c83
-
Filesize
90KB
MD522b53b7f2d215f4200c7aa3aff71ad94
SHA17a7e9c437145513830f7a60ca9ca111bd54ee67d
SHA2568154260b68544873a1d2d4c99f7e39a1b85355cf4a3ad239caa6d2ebc11f8720
SHA512db1fe928f82dde536b200f83679c32c579d9dd7b034e34311733c2328ceabbb6b159b36b7b512c49f99620a96ee4827dced674b25432d0bcb8bd5a0dea01c71a
-
Filesize
90KB
MD584544ca5dd6c1fa334f39723f15de3aa
SHA15fba63b4006f5812d159ca2f3e5ea88ce1a4ae2d
SHA256e4b08b13d6dfb0b544563cc7cf274562643874acbc9314af4eb8b2d669633cd6
SHA5120cd7954126ee3bbdbc0fbfb3a31c3b2ba2ed8acd9ab9b66b83602cc6bafbfa9bff74440da209a7cc3213902c1fcfb0d0107602c9a07747dff2a76c5f60726eed
-
Filesize
90KB
MD58374d91e3f5f4b892e017cb28b9e5a4a
SHA1dde483dfedd8e336b7b2c4be5552c856499ea853
SHA25676c1dff7035090819f07f4da886bfaa49963c0a128be876586f11b5139c01c97
SHA5124abec7988e32dd7e5e0a097b09f41dbcf8d7caf343304300921006912dfa4c69ce33ad70136a8ffd5662cd03f977dd1583c4f1ec6352fe8ea10cfb7fdc45d70e
-
Filesize
90KB
MD54515dc7e1bdd4460afb039b2b4eeee8b
SHA195f8f27f4c5b2955e47b57daa949a403f00a86a6
SHA25627b3417e19593a6ba0b53ed54b2cda9e961714093f8a609d08c8cbec4ad8c171
SHA5127eea16061b5cd5a49d9f58af23efaa87951295b863e5848d46c1bf712650f13ca6442a4db8dc0a79e31c3af9abcd0625648e82b21d067d154fee545ca48973e7