Analysis
-
max time kernel
118s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
Resource
win10v2004-20241007-en
General
-
Target
449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe
-
Size
90KB
-
MD5
c7c1619de6fffe00344fd1cf305bf90f
-
SHA1
71dba18f0795099f0ce43f77f38e1c22aff18b8b
-
SHA256
1132de8a4f69e915a2a8a55ff1468a0676c89581b5513847febb35fc4c6ee730
-
SHA512
27de386433284d465977c6a0e449a900a96d08ed532a2978c652b2ddf841e55f99c75ed46d99d2c99b3e5170fe331072d15f7d5a6da2f0641febace1edaaafba
-
SSDEEP
768:Qvw9816vhKQLroH4/wQRNrfrunMxVFA3b7gl4:YEGh0oHl2unMxVS3HgG
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37DB36FA-815B-4160-A971-68236282999A} {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82E763B6-276D-4730-A2C4-757D466869FE}\stubpath = "C:\\Windows\\{82E763B6-276D-4730-A2C4-757D466869FE}.exe" {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{071AA0F7-92F8-408f-A434-4C8379165464} {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72AFF128-1022-4ca6-B050-648EAECDDC2E}\stubpath = "C:\\Windows\\{72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe" {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55B86B44-663D-4439-A03E-D62DC9D15BD4} 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13828EEA-C735-48e7-AD41-CCCC23DB16DA} {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13828EEA-C735-48e7-AD41-CCCC23DB16DA}\stubpath = "C:\\Windows\\{13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe" {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594244E7-C045-46a4-8C3A-15CB14D025BF} {071AA0F7-92F8-408f-A434-4C8379165464}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{594244E7-C045-46a4-8C3A-15CB14D025BF}\stubpath = "C:\\Windows\\{594244E7-C045-46a4-8C3A-15CB14D025BF}.exe" {071AA0F7-92F8-408f-A434-4C8379165464}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3} {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}\stubpath = "C:\\Windows\\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe" {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55B86B44-663D-4439-A03E-D62DC9D15BD4}\stubpath = "C:\\Windows\\{55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe" 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{071AA0F7-92F8-408f-A434-4C8379165464}\stubpath = "C:\\Windows\\{071AA0F7-92F8-408f-A434-4C8379165464}.exe" {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72AFF128-1022-4ca6-B050-648EAECDDC2E} {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37DB36FA-815B-4160-A971-68236282999A}\stubpath = "C:\\Windows\\{37DB36FA-815B-4160-A971-68236282999A}.exe" {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1294328C-014D-4fb8-B963-FDD6FD6F2745} {37DB36FA-815B-4160-A971-68236282999A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1294328C-014D-4fb8-B963-FDD6FD6F2745}\stubpath = "C:\\Windows\\{1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe" {37DB36FA-815B-4160-A971-68236282999A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82E763B6-276D-4730-A2C4-757D466869FE} {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe -
Executes dropped EXE 9 IoCs
pid Process 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 932 {82E763B6-276D-4730-A2C4-757D466869FE}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe File created C:\Windows\{071AA0F7-92F8-408f-A434-4C8379165464}.exe {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe File created C:\Windows\{594244E7-C045-46a4-8C3A-15CB14D025BF}.exe {071AA0F7-92F8-408f-A434-4C8379165464}.exe File created C:\Windows\{72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe File created C:\Windows\{55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe File created C:\Windows\{37DB36FA-815B-4160-A971-68236282999A}.exe {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe File created C:\Windows\{1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe {37DB36FA-815B-4160-A971-68236282999A}.exe File created C:\Windows\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe File created C:\Windows\{82E763B6-276D-4730-A2C4-757D466869FE}.exe {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {071AA0F7-92F8-408f-A434-4C8379165464}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {37DB36FA-815B-4160-A971-68236282999A}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {82E763B6-276D-4730-A2C4-757D466869FE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe Token: SeIncBasePriorityPrivilege 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe Token: SeIncBasePriorityPrivilege 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe Token: SeIncBasePriorityPrivilege 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe Token: SeIncBasePriorityPrivilege 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe Token: SeIncBasePriorityPrivilege 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe Token: SeIncBasePriorityPrivilege 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe Token: SeIncBasePriorityPrivilege 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe Token: SeIncBasePriorityPrivilege 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 5100 wrote to memory of 1548 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 94 PID 5100 wrote to memory of 1548 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 94 PID 5100 wrote to memory of 1548 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 94 PID 5100 wrote to memory of 924 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 95 PID 5100 wrote to memory of 924 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 95 PID 5100 wrote to memory of 924 5100 449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe 95 PID 1548 wrote to memory of 1508 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 96 PID 1548 wrote to memory of 1508 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 96 PID 1548 wrote to memory of 1508 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 96 PID 1548 wrote to memory of 2892 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 97 PID 1548 wrote to memory of 2892 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 97 PID 1548 wrote to memory of 2892 1548 {55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe 97 PID 1508 wrote to memory of 980 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 100 PID 1508 wrote to memory of 980 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 100 PID 1508 wrote to memory of 980 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 100 PID 1508 wrote to memory of 4236 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 101 PID 1508 wrote to memory of 4236 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 101 PID 1508 wrote to memory of 4236 1508 {13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe 101 PID 980 wrote to memory of 3396 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 102 PID 980 wrote to memory of 3396 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 102 PID 980 wrote to memory of 3396 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 102 PID 980 wrote to memory of 1416 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 103 PID 980 wrote to memory of 1416 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 103 PID 980 wrote to memory of 1416 980 {071AA0F7-92F8-408f-A434-4C8379165464}.exe 103 PID 3396 wrote to memory of 4552 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 104 PID 3396 wrote to memory of 4552 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 104 PID 3396 wrote to memory of 4552 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 104 PID 3396 wrote to memory of 4788 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 105 PID 3396 wrote to memory of 4788 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 105 PID 3396 wrote to memory of 4788 3396 {594244E7-C045-46a4-8C3A-15CB14D025BF}.exe 105 PID 4552 wrote to memory of 1564 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 106 PID 4552 wrote to memory of 1564 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 106 PID 4552 wrote to memory of 1564 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 106 PID 4552 wrote to memory of 1664 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 107 PID 4552 wrote to memory of 1664 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 107 PID 4552 wrote to memory of 1664 4552 {72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe 107 PID 1564 wrote to memory of 4336 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 108 PID 1564 wrote to memory of 4336 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 108 PID 1564 wrote to memory of 4336 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 108 PID 1564 wrote to memory of 4344 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 109 PID 1564 wrote to memory of 4344 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 109 PID 1564 wrote to memory of 4344 1564 {37DB36FA-815B-4160-A971-68236282999A}.exe 109 PID 4336 wrote to memory of 3356 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 110 PID 4336 wrote to memory of 3356 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 110 PID 4336 wrote to memory of 3356 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 110 PID 4336 wrote to memory of 4952 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 111 PID 4336 wrote to memory of 4952 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 111 PID 4336 wrote to memory of 4952 4336 {1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe 111 PID 3356 wrote to memory of 932 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 112 PID 3356 wrote to memory of 932 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 112 PID 3356 wrote to memory of 932 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 112 PID 3356 wrote to memory of 1756 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 113 PID 3356 wrote to memory of 1756 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 113 PID 3356 wrote to memory of 1756 3356 {C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe"C:\Users\Admin\AppData\Local\Temp\449984a440b3d8805843069d61000506c62e9e9c8c73eacb27f1fa55de29a9ddN.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\{55B86B44-663D-4439-A03E-D62DC9D15BD4}.exeC:\Windows\{55B86B44-663D-4439-A03E-D62DC9D15BD4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\{13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exeC:\Windows\{13828EEA-C735-48e7-AD41-CCCC23DB16DA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\{071AA0F7-92F8-408f-A434-4C8379165464}.exeC:\Windows\{071AA0F7-92F8-408f-A434-4C8379165464}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\{594244E7-C045-46a4-8C3A-15CB14D025BF}.exeC:\Windows\{594244E7-C045-46a4-8C3A-15CB14D025BF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\{72AFF128-1022-4ca6-B050-648EAECDDC2E}.exeC:\Windows\{72AFF128-1022-4ca6-B050-648EAECDDC2E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\{37DB36FA-815B-4160-A971-68236282999A}.exeC:\Windows\{37DB36FA-815B-4160-A971-68236282999A}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\{1294328C-014D-4fb8-B963-FDD6FD6F2745}.exeC:\Windows\{1294328C-014D-4fb8-B963-FDD6FD6F2745}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exeC:\Windows\{C70AF2B9-2705-4de3-9E50-02A1D2DCF3D3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\{82E763B6-276D-4730-A2C4-757D466869FE}.exeC:\Windows\{82E763B6-276D-4730-A2C4-757D466869FE}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C70AF~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{12943~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37DB3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72AFF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59424~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:4788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{071AA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13828~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:4236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55B86~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\449984~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD53b9a0ddf6e52116798361f3f17a2b84f
SHA1f76de4c90352564a85ff735fa79a014d8acb9464
SHA256070ecbfff2908c5108094b271fa70dd4e4c9ceebde1bda948d4b2155b1e4a11e
SHA512a283438bad5e4282f429f3f6e22df42d453b1a6c1b5f6c7ae558a19d59ebdb418be7e358a8726e00ad920314c3492ddd3773d725a1dff8c1fd496860b57b9057
-
Filesize
90KB
MD54258c4247e788d30168f8161f462d05c
SHA1a51ffa0ae0387ac560b7e60572714ac9b7c59f88
SHA2567214640cbf4e7b88f310d55adbb43e1f6d5be46ebb587f42cc2c21487e4c2f9a
SHA512d932e0328c23d532fbcddca592c0003263cc4420106ebf8dd19f793e9c82ff51c80490c5d7d3f8c696a36091632f9da3ecb437951c8daf6117a6323ea8e7ad3d
-
Filesize
90KB
MD56c4d2a1961bb95f51ac3a15195144cf5
SHA19e75bdb35a18edc304254c380ca333038c45c20d
SHA25652a4542fc2c45a1deb69bbc482c386492aa5eb4e15ab2bfee56d6eadb1a7b5b9
SHA51225bc44380cec29e2f272291e80068587318785f369060138eb85969b802e4dd9f6e1c213899c888cb629be757d1b8cdd53862451b9e23cb813bf0060104a46de
-
Filesize
90KB
MD5f0fab57bd0623d70d996097ca5e83a7b
SHA1de2234f724f24c4338b38d26b2cf0ac15f52e9e4
SHA2567166d1b08d4d86eb38c7d5a0fd3f54e3ea7da95aeef8462232215b976d218424
SHA51227ec875299e42ba5ed268b9cdc087298e3d75a895826929d074837e0e691010faa6773b90403a817c09de57a275ac9fbcf1585fa848a6dbe8166236c595c69d3
-
Filesize
90KB
MD5b990dfc0ededfd963017dc82aa0948ef
SHA1a16c3befbbe496711823fadac519712a05d03282
SHA256ebb1d56b7fc9637f869b21ff918bcf76b6d29922bccd5263667f714e9424888e
SHA512d48679636658d2d179a79550f05475b430f4c9332d4f28dc8bf75904f255982f8807d72fdda85989e262d87b08a40b787eef283fbd050ccd139a29c82595c903
-
Filesize
90KB
MD532045503fcd29c0685839929fb576314
SHA1d04acf96bda21e329aebb96b3c7fba88e3a00a17
SHA256a9ed8320010a58eb05217cd4e858a88b8054cb9c66749347f3fd878dd413f2e1
SHA51237e47690200cb4a5c9a43741939f60d332fd06990fbb80ad50acfed14769d4d026e8fd16fc62459ff9547cfa7749526bb2e9e5ae365e2c5e3cd1f0b8838db835
-
Filesize
90KB
MD54d4f18010b6da167220524bf5d717722
SHA18f2d36274671b2571212b7c08a94e830c8a9fde3
SHA256d26b7254a2bf06f64fdf0f27b298af63b7a0e45c15cbe892bf620dfda84ab6a9
SHA512cbf39ab5f87858a96220cef293b5fb6007c3e68a9615c6a97b795794f1088c38e354bd34438290959c0aa8014d79cb7b9941b6152c8eec93bdc264a16a8c9d1d
-
Filesize
90KB
MD51e4bb860f56bf494169e5ff77ed779b8
SHA19c0f9b62dd6b3e3a5e90fc9e136574dc947c0845
SHA256ab9b4c3e70d2597188241d57ea0adbbcd8f556353a93a59e97c22311c9848a6a
SHA512f6c703316a033dfa649b77638ea8e0b7e45a2e1a59a8ad189b3ef48ebb628f2aaeb0dc11581ef0f94c6e1bb43ae124a8d976bd964b9453c5fab8ebdecd250fd9
-
Filesize
90KB
MD57b3a97f3026625a071771020163f9d0a
SHA1ed459be7baa97201beba5630364608adbc80f9a5
SHA256931e5bab0fe7b4490dc0a2f4fd2694e44cb0c3ecd6c7e98585ca0c296a58ed46
SHA5123c325c8f89a11540ca414c1bac990f99f5fe9d4b4b10032d3cc6a5025243dbc6f4e58dc4c96680d52f1d3903efbb93522296d78b5272acb1c223a5d48c6b6adf