Analysis
- max time kernel
118s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/01/2025, 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
Behavioral task
behavioral2
Sample
09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
120 seconds
General
- Target 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe
- Size 372KB
- Sample250127-saaj6atmes
- SHA256 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd
- MD5 5a5c49e23b9997343def69e39172dd87
- SHA1 6a4be7ebd078d6cfc8dd057fae6f57e885540958
- SHA512 2cea3ce43b8440d7fcaa945ce6e363ab5d276b3bd8b524912176e4872364cc865e07842f759ad7630247829f797c8c24d919560cec3de436fab3bd049cd8842b
- SSDEEP 3072:CEGh0oVmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGSl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}\stubpath = "C:\\Windows\\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe" {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4ADAC480-5953-46ac-8C27-6CA361F58927} {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4ADAC480-5953-46ac-8C27-6CA361F58927}\stubpath = "C:\\Windows\\{4ADAC480-5953-46ac-8C27-6CA361F58927}.exe" {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8596DCD8-0AC0-4666-97B8-995B86AF347F}\stubpath = "C:\\Windows\\{8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe" {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{127E3043-7A32-46d6-AE94-173C42F06898} {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{127E3043-7A32-46d6-AE94-173C42F06898}\stubpath = "C:\\Windows\\{127E3043-7A32-46d6-AE94-173C42F06898}.exe" {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67453D4D-14D1-4466-9BDD-F93776C32C50}\stubpath = "C:\\Windows\\{67453D4D-14D1-4466-9BDD-F93776C32C50}.exe" {127E3043-7A32-46d6-AE94-173C42F06898}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82} {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B} {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8596DCD8-0AC0-4666-97B8-995B86AF347F} {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67453D4D-14D1-4466-9BDD-F93776C32C50} {127E3043-7A32-46d6-AE94-173C42F06898}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E01CD73-8C91-48be-A215-C885CC2F2754} {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A424587-1561-427e-863B-E9C2EE03C75F} {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{961B190B-E2A1-4743-98DA-B8DDFCE70111} 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{961B190B-E2A1-4743-98DA-B8DDFCE70111}\stubpath = "C:\\Windows\\{961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe" 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}\stubpath = "C:\\Windows\\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe" {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E01CD73-8C91-48be-A215-C885CC2F2754}\stubpath = "C:\\Windows\\{0E01CD73-8C91-48be-A215-C885CC2F2754}.exe" {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A424587-1561-427e-863B-E9C2EE03C75F}\stubpath = "C:\\Windows\\{4A424587-1561-427e-863B-E9C2EE03C75F}.exe" {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe - Executes dropped EXE 9 IoCs
pid Process 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 1620 {4A424587-1561-427e-863B-E9C2EE03C75F}.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe File created C:\Windows\{127E3043-7A32-46d6-AE94-173C42F06898}.exe {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe File created C:\Windows\{67453D4D-14D1-4466-9BDD-F93776C32C50}.exe {127E3043-7A32-46d6-AE94-173C42F06898}.exe File created C:\Windows\{4A424587-1561-427e-863B-E9C2EE03C75F}.exe {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe File created C:\Windows\{961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe File created C:\Windows\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe File created C:\Windows\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe File created C:\Windows\{4ADAC480-5953-46ac-8C27-6CA361F58927}.exe {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe File created C:\Windows\{0E01CD73-8C91-48be-A215-C885CC2F2754}.exe {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4A424587-1561-427e-863B-E9C2EE03C75F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {127E3043-7A32-46d6-AE94-173C42F06898}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe Token: SeIncBasePriorityPrivilege 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe Token: SeIncBasePriorityPrivilege 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe Token: SeIncBasePriorityPrivilege 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe Token: SeIncBasePriorityPrivilege 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe Token: SeIncBasePriorityPrivilege 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe Token: SeIncBasePriorityPrivilege 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe Token: SeIncBasePriorityPrivilege 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe Token: SeIncBasePriorityPrivilege 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 4812 wrote to memory of 3908 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 92 PID 4812 wrote to memory of 3908 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 92 PID 4812 wrote to memory of 3908 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 92 PID 4812 wrote to memory of 1628 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 93 PID 4812 wrote to memory of 1628 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 93 PID 4812 wrote to memory of 1628 4812 09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe 93 PID 3908 wrote to memory of 872 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 98 PID 3908 wrote to memory of 872 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 98 PID 3908 wrote to memory of 872 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 98 PID 3908 wrote to memory of 2348 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 99 PID 3908 wrote to memory of 2348 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 99 PID 3908 wrote to memory of 2348 3908 {961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe 99 PID 872 wrote to memory of 3416 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 103 PID 872 wrote to memory of 3416 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 103 PID 872 wrote to memory of 3416 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 103 PID 872 wrote to memory of 2696 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 104 PID 872 wrote to memory of 2696 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 104 PID 872 wrote to memory of 2696 872 {3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe 104 PID 3416 wrote to memory of 868 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 105 PID 3416 wrote to memory of 868 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 105 PID 3416 wrote to memory of 868 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 105 PID 3416 wrote to memory of 1356 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 106 PID 3416 wrote to memory of 1356 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 106 PID 3416 wrote to memory of 1356 3416 {6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe 106 PID 868 wrote to memory of 4968 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 107 PID 868 wrote to memory of 4968 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 107 PID 868 wrote to memory of 4968 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 107 PID 868 wrote to memory of 756 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 108 PID 868 wrote to memory of 756 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 108 PID 868 wrote to memory of 756 868 {4ADAC480-5953-46ac-8C27-6CA361F58927}.exe 108 PID 4968 wrote to memory of 408 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 109 PID 4968 wrote to memory of 408 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 109 PID 4968 wrote to memory of 408 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 109 PID 4968 wrote to memory of 4284 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 110 PID 4968 wrote to memory of 4284 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 110 PID 4968 wrote to memory of 4284 4968 {8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe 110 PID 408 wrote to memory of 2716 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 111 PID 408 wrote to memory of 2716 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 111 PID 408 wrote to memory of 2716 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 111 PID 408 wrote to memory of 548 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 112 PID 408 wrote to memory of 548 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 112 PID 408 wrote to memory of 548 408 {127E3043-7A32-46d6-AE94-173C42F06898}.exe 112 PID 2716 wrote to memory of 1972 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 113 PID 2716 wrote to memory of 1972 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 113 PID 2716 wrote to memory of 1972 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 113 PID 2716 wrote to memory of 3644 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 114 PID 2716 wrote to memory of 3644 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 114 PID 2716 wrote to memory of 3644 2716 {67453D4D-14D1-4466-9BDD-F93776C32C50}.exe 114 PID 1972 wrote to memory of 1620 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 115 PID 1972 wrote to memory of 1620 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 115 PID 1972 wrote to memory of 1620 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 115 PID 1972 wrote to memory of 2664 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 116 PID 1972 wrote to memory of 2664 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 116 PID 1972 wrote to memory of 2664 1972 {0E01CD73-8C91-48be-A215-C885CC2F2754}.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe"C:\Users\Admin\AppData\Local\Temp\09e758eceddfa39186c204eea96431cc5ec5babd2e0670dff77abf95e64bccdd.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\{961B190B-E2A1-4743-98DA-B8DDFCE70111}.exeC:\Windows\{961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exeC:\Windows\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exeC:\Windows\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\{4ADAC480-5953-46ac-8C27-6CA361F58927}.exeC:\Windows\{4ADAC480-5953-46ac-8C27-6CA361F58927}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\{8596DCD8-0AC0-4666-97B8-995B86AF347F}.exeC:\Windows\{8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\{127E3043-7A32-46d6-AE94-173C42F06898}.exeC:\Windows\{127E3043-7A32-46d6-AE94-173C42F06898}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\{67453D4D-14D1-4466-9BDD-F93776C32C50}.exeC:\Windows\{67453D4D-14D1-4466-9BDD-F93776C32C50}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\{0E01CD73-8C91-48be-A215-C885CC2F2754}.exeC:\Windows\{0E01CD73-8C91-48be-A215-C885CC2F2754}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\{4A424587-1561-427e-863B-E9C2EE03C75F}.exeC:\Windows\{4A424587-1561-427e-863B-E9C2EE03C75F}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E01C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67453~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:3644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{127E3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8596D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4ADAC~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B21B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F4EC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{961B1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\09E758~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:1628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0E01CD73-8C91-48be-A215-C885CC2F2754}.exe
- Size 372KB
- SHA256 8109e9f734ad49cfdcf120557df144a3b5eadebb5adc189ec7d4bfca2ae49421
- MD5 76cc78369b81c5ecf1e8d40db689e530
- SHA1 2e5bc50ac91010e653b2bf30225f33fa268fa8b6
- SHA512 ebc16fcd3294ac15c52b4d8a2cd0beab7b24f376f360d9e455b0d2b7876e84e03e4413387d233075aa1ae969b47d047def7ca33b47c3342df99c58cdfadf40eb
- SSDEEP 3072:CEGh0ovmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGgl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{127E3043-7A32-46d6-AE94-173C42F06898}.exe
- Size 372KB
- SHA256 4450fc7098471daaccd9c5fe677758cb003a97034e81a2920bb696773d27a8d2
- MD5 a741353018b7992826ce004516379c79
- SHA1 76cbc2533e6fac12e0acd7b0d30715444e9a2f61
- SHA512 251b8592f8ab2997261014435e3e258c6582b2b564d4983448abee2aec72fe5020e34078d8b86eb3952d6148665d0af6408b41a342bca864d5689d7f5938b9d6
- SSDEEP 3072:CEGh0obmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGUl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3F4EC2A2-8BAD-4e1d-9526-F3718A07FA82}.exe
- Size 372KB
- SHA256 7d11e5a1e5002c9724d8604e4e08a0f9f30dc3e8b23291de3d796c11dcd05803
- MD5 861c803357f8ed9b69264ca5ea5db8d8
- SHA1 4fb50b1662320a938301ab3b8999edd65ad3bcac
- SHA512 47f972c48d737a6b0ccd120424b5b82ea9dde88be28babe1d91c09fce0c6c0b0da756d40e10d5f464b985153cd82fdeb4f1ad31b6a98733204455b3858366d6d
- SSDEEP 3072:CEGh0o8mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEG3l/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4A424587-1561-427e-863B-E9C2EE03C75F}.exe
- Size 372KB
- SHA256 bb221c143fbda9f1fbbb92ef9d65e9451cef36a490822eaf5bfa17238865ab6a
- MD5 673600ba07144db4fb97479983c8e07a
- SHA1 3fbdc672ed5052359aabea0f1ee94859f0e459ff
- SHA512 c925bfc9cceeb31cf8bd2986824ce634bf925357efcdbe2e729284e2aef17ed86ab7a5e7e81972337e4598e7827b97aeea18715eb672d48c933aecd69adc1fd2
- SSDEEP 3072:CEGh0ohmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGul/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4ADAC480-5953-46ac-8C27-6CA361F58927}.exe
- Size 372KB
- SHA256 a1d1b244e8eab3707c0449529275bdf006526054227e0a3c9629552cc5a257bc
- MD5 b3b53b9436b34513018e544989899a0f
- SHA1 7c368b14480fc20a28ec3a9871ab84d3d52c8dcd
- SHA512 e28f3b6f1fcd8314933fc1c6cc8a62df9d4dff599c3d1f9524d4dc325d2ea33d739c73aade4a53c9d97fd4ee7df3fe860f245c2a47b62103f1ab63921a0ee835
- SSDEEP 3072:CEGh0ojmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGwl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{67453D4D-14D1-4466-9BDD-F93776C32C50}.exe
- Size 372KB
- SHA256 fb8b53bc84404c76f86d2186c5f35109e2e57918842ca2daac95fa750dc541d0
- MD5 f1ed4dc095ecfad4704838c0f61ad7fa
- SHA1 0151ac0c71acb22dbee4739f840795c640414e27
- SHA512 4ebfaa69581b02a7299cbeb9a9b1eb24c46a8fd4a3bd3e195acea1a7cabe162f26e322b84356013ee5aa37c9d74aca278cd2510e5c48d261db31c16112c29a98
- SSDEEP 3072:CEGh0oPmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGgl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6B21BECE-DEFE-4952-A262-71C7CBAC3A9B}.exe
- Size 372KB
- SHA256 b363caad42bc9068b6957ac22d135d5dbb5601513f241c36a0c6e8ef56321b53
- MD5 43ed51b56360543a3e4028aa2c4f0711
- SHA1 d658890aa63a0fd26fb15477ad57afc1dcaa0799
- SHA512 613c50feff27773a56f0eeb69e1b38eda87a6a416c32b7963730cfb27140ab4382c4d4a85f1244d55b3705a9974614cf73fd88f62c635000112d0b4492d5c491
- SSDEEP 3072:CEGh0o8mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEG/l/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8596DCD8-0AC0-4666-97B8-995B86AF347F}.exe
- Size 372KB
- SHA256 042a5d362182b54604b0f18746ecb817763dbd7f024a93a924b83a2f91af66be
- MD5 cf2021ed78c05d7cc557b9e8ad5f0d33
- SHA1 7d5d2b1105fef082e60ca295ad0d905868786d79
- SHA512 87f3a322c364f54f77881ae2edab0ba8ac01ceac0d640a882ae2feaafbfdffc722e16320d3b52a01b5103ce61f68a1b51c6790334a37202f8fe87b27b49c10eb
- SSDEEP 3072:CEGh0oImlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGzl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{961B190B-E2A1-4743-98DA-B8DDFCE70111}.exe
- Size 372KB
- SHA256 44b9ba8a891ea66a4a130c529451d54cefa499c29fcc2139f55f9b5d0669a175
- MD5 ca38783ee35922736614899a0685335c
- SHA1 cdfdba1287a3913498ae547792332af6d8fbb3e2
- SHA512 13d43d81850596a089becbbb7f2a8daaf901d867d109f9685a2ad0b5900946928ca32d1e1ad6ee093994d7abe6090c8a7ca69e2caf4382064b94717d2a2b74c9
- SSDEEP 3072:CEGh0o6mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBM:CEGdl/Oe2MUVg3vTeKcAEciTBqr3z
- MD5 SHA1 SHA512 SSDEEP