d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf

Analysis

max time kernel
118s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe
Size 28KB
Sample250127-sbb5datnaw
SHA256 d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf
MD5 89f328cd9065173618ef4ab0c16d2b0e
SHA1 4ccec8842a92adf9385f182b1d0c34ea0fcc18cf
SHA512 9616291364704740b5a904de1962109ad9958f249e954f1cc674932acb87acae269fcc8319b997469d4677d2150b5956e820ecf50a0a160dee94b29073b8f515
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIUFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LJXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}\stubpath = "C:\\Windows\\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe"	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}\stubpath = "C:\\Windows\\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe"	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}\stubpath = "C:\\Windows\\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe"	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}\stubpath = "C:\\Windows\\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe"	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13471E15-53C5-4c50-B22A-584800192C74}	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}\stubpath = "C:\\Windows\\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe"	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}\stubpath = "C:\\Windows\\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe"	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}\stubpath = "C:\\Windows\\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe"	{13471E15-53C5-4c50-B22A-584800192C74}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}\stubpath = "C:\\Windows\\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe"	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13471E15-53C5-4c50-B22A-584800192C74}\stubpath = "C:\\Windows\\{13471E15-53C5-4c50-B22A-584800192C74}.exe"	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}	{13471E15-53C5-4c50-B22A-584800192C74}.exe

Executes dropped EXE 9 IoCs

pid	Process
2716	{13471E15-53C5-4c50-B22A-584800192C74}.exe
3872	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
1604	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
440	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
3620	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
3880	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
212	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
2996	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
4480	{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4680-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4680-1-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0007000000023c97-4.dat	upx
behavioral2/memory/4680-6-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0007000000023cab-10.dat	upx
behavioral2/memory/2716-12-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000a000000023cb2-14.dat	upx
behavioral2/memory/3872-18-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000d000000023cb3-22.dat	upx
behavioral2/memory/1604-24-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0002000000021ea9-28.dat	upx
behavioral2/memory/440-30-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0005000000021eaa-34.dat	upx
behavioral2/memory/3620-37-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x00090000000226c9-41.dat	upx
behavioral2/memory/3880-43-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0003000000000709-47.dat	upx
behavioral2/memory/212-49-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000600000000070b-52.dat	upx
behavioral2/memory/2996-55-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
File created	C:\Windows\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
File created	C:\Windows\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
File created	C:\Windows\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
File created	C:\Windows\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe	{13471E15-53C5-4c50-B22A-584800192C74}.exe
File created	C:\Windows\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
File created	C:\Windows\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
File created	C:\Windows\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
File created	C:\Windows\{13471E15-53C5-4c50-B22A-584800192C74}.exe	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2296	4680	WerFault.exe	82
5012	2716	WerFault.exe	90
4100	3872	WerFault.exe	101
1888	1604	WerFault.exe	107
228	440	WerFault.exe	110
5108	3620	WerFault.exe	113
3412	3880	WerFault.exe	116
3696	212	WerFault.exe	119
2636	2996	WerFault.exe	122

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{13471E15-53C5-4c50-B22A-584800192C74}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2716	4680	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe	90
PID 4680 wrote to memory of 2716	4680	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe	90
PID 4680 wrote to memory of 2716	4680	d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe	90
PID 2716 wrote to memory of 3872	2716	{13471E15-53C5-4c50-B22A-584800192C74}.exe	101
PID 2716 wrote to memory of 3872	2716	{13471E15-53C5-4c50-B22A-584800192C74}.exe	101
PID 2716 wrote to memory of 3872	2716	{13471E15-53C5-4c50-B22A-584800192C74}.exe	101
PID 3872 wrote to memory of 1604	3872	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe	107
PID 3872 wrote to memory of 1604	3872	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe	107
PID 3872 wrote to memory of 1604	3872	{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe	107
PID 1604 wrote to memory of 440	1604	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe	110
PID 1604 wrote to memory of 440	1604	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe	110
PID 1604 wrote to memory of 440	1604	{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe	110
PID 440 wrote to memory of 3620	440	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe	113
PID 440 wrote to memory of 3620	440	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe	113
PID 440 wrote to memory of 3620	440	{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe	113
PID 3620 wrote to memory of 3880	3620	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe	116
PID 3620 wrote to memory of 3880	3620	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe	116
PID 3620 wrote to memory of 3880	3620	{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe	116
PID 3880 wrote to memory of 212	3880	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe	119
PID 3880 wrote to memory of 212	3880	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe	119
PID 3880 wrote to memory of 212	3880	{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe	119
PID 212 wrote to memory of 2996	212	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe	122
PID 212 wrote to memory of 2996	212	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe	122
PID 212 wrote to memory of 2996	212	{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe	122
PID 2996 wrote to memory of 4480	2996	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe	125
PID 2996 wrote to memory of 4480	2996	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe	125
PID 2996 wrote to memory of 4480	2996	{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe	125

C:\Users\Admin\AppData\Local\Temp\d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe
"C:\Users\Admin\AppData\Local\Temp\d906b52e39fbd3d174bc7ceecde5d6a45ff0c9c60cec66d9d9a38364bfd470cf.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\{13471E15-53C5-4c50-B22A-584800192C74}.exe
  C:\Windows\{13471E15-53C5-4c50-B22A-584800192C74}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
    C:\Windows\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
      C:\Windows\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Windows\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
        
        C:\Windows\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Windows\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
        
        C:\Windows\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
        
        C:\Windows\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
        
        C:\Windows\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
        
        C:\Windows\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe
        
        C:\Windows\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 808
        10⤵
        Program crash
        
        PID:2636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 732
        9⤵
        Program crash
        
        PID:3696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 780
        8⤵
        Program crash
        
        PID:3412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 804
        7⤵
        Program crash
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 744
        6⤵
        Program crash
        
        PID:228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 696
        5⤵
        Program crash
        
        PID:1888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 764
      4⤵
      Program crash
      PID:4100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 696
    3⤵
    - Program crash
    PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 736
  2⤵
  - Program crash
  PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4680 -ip 4680
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2716 -ip 2716
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3872 -ip 3872
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1604 -ip 1604
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 440 -ip 440
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3620 -ip 3620
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3880 -ip 3880
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 212 -ip 212
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2996 -ip 2996
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{13471E15-53C5-4c50-B22A-584800192C74}.exe

Path C:\Windows\{13471E15-53C5-4c50-B22A-584800192C74}.exe
Size 28KB
SHA256 318e62552b37edffa859012342da778f8b213f067af893b4c480019a332070e6
MD5 305babb2439fb439194fc39c2434c399
SHA1 d06ec8f44cd1387e7625cfef3739e95d549cbceb
SHA512 0db5351026e021c4bc273252ed54fe6ee99b224e2b51806ad8fa80cd1c271d46133dea09e1d22b88ec3ed92ba5c432ad7e5eca2ec9ab5511bb00fd09c2d31b35
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIhFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2L0XOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe

Path C:\Windows\{77614FDD-040D-4c9a-B803-65BEB1C5B32C}.exe
Size 28KB
SHA256 729608b60b658d6718a96dc7e67a67e0937577fba7fdabb4cb5c29893a97859e
MD5 7cdadb399c1804c896377f45ce55b443
SHA1 b979ef0c4427d8ee77715c261e0a678422bd3298
SHA512 e698914d263221483da9a370897ac092bc9e9f779ed6d2461c9d6376e5a640809087033083f24db4fee62c6d96558beee0a88b26d1239735ea497816a1bd0645
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIKvFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LxvXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe

Path C:\Windows\{A1318A49-4ED1-4fbc-939C-76AEA74B9A51}.exe
Size 28KB
SHA256 85b10ffd5f54f1afea01b8f0c26775f524b437934b228aac6a99ec9fe8b2c2e9
MD5 ff0062edd426e1cc46782c1ac332ade5
SHA1 1eabbfbb334bcb83278abbf7930bba56a032240a
SHA512 5d001c5e079a4ecf7c1510ba4ec4b5cc80e94726dc09c7b274c7ddccd0ae6986bc8fb076b3a72c48c39871f9d2335ce74368a3f36cd10c1e586cefc1021e4ef2
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapI4FpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LFXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe

Path C:\Windows\{B3FB87B5-1149-4a6e-8427-B6D621F812A6}.exe
Size 28KB
SHA256 2ce4b2117848623c766329041ecd6937e61bb501034253ea88d84c75c6abbd3a
MD5 b04b6181f89cc597ec2dc8dc3cd3d546
SHA1 688a7b125b237e1c1d7c476c456f6616a6c9b585
SHA512 144b9632f1762122b16eb589a13230f05d968d15fef332bf2118cd53f979efc472e985a36deb3a6564ef2c6235972d8accf412fd86e4f10aca7d1fb1fe1e9e11
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapI8FpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LVXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe

Path C:\Windows\{B4B71899-6BB2-45d9-AD3F-77EA80C42B4B}.exe
Size 28KB
SHA256 c5dde0ca58d6925c632d7d9ae47369f10e84685a97ae5dc41cf5a034157c11f1
MD5 b4c09746d49c3d275d0b4ec62a4cfe75
SHA1 f2c02fabdba77b110226fb36cc522c2492ae02f9
SHA512 62bcecdaa745a650ade3ed1deeb775ca0c0f3822500aab9cc269cfc48293e2dbffbb2ccb2e14a1b45598dbd0b58e487b27df87b3c7f9a5dc554359a2f26ce3a0
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIvFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LWXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe

Path C:\Windows\{BEFB07B0-98F1-46bb-A9B0-5901DFD365B3}.exe
Size 28KB
SHA256 9660b2d1f2a3060007160d560be436cce223c06065f4caf290737bf85c864cd1
MD5 a7a6993179438a2a3daf308374f61504
SHA1 cc9f93e0b4594b16d970e8e7cd2b399aff85594a
SHA512 f5485e743dcea0e807ee34428e46b9564e7eb6029638078aedc39923b228b08a231f73a30d9637d72a723adea6069fa261dff1fc680a0e029d7ca5d747cbdeb9
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIOFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LvXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe

Path C:\Windows\{E6619CBB-03E9-4bf0-82F3-6C868DF1D193}.exe
Size 28KB
SHA256 3d165d7d9dab2945b761a1b536aa88e34775024d3e8761b52d7ba4fac3099646
MD5 a4e5160293b97a8f379737b232ffc2e6
SHA1 8aa550e3915ac2c662e9b6e68e40c87bb9548376
SHA512 8f9c9e37fb43e66e90015a2ec9874b72863b30513977ffd8e58255b3b9977525d92daaa09140e1d411b6c9dee2ee2b5f4b13b395bc77f43879204be5074d8454
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIrFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LuXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe

Path C:\Windows\{EAEA7A5F-C665-4622-9353-1A4CEC2E0FBD}.exe
Size 28KB
SHA256 c9629468d70c66bce1c122d9c40795246c7a778ed7d2dca4e6102cbeddc2fc7a
MD5 d60d6acbe1e93ce20683ea3eefa9a63d
SHA1 d8c8d388af51b57c123dd3ca0705cb3dfab99f70
SHA512 c5c6b72fb73d34baceea04122aa1eb2301aa2c5034aa2c3a9edcaa324570f461147cb3c12a59e5577c9b89fb7cbb50800ea88d08f40962e846fd9d5b2e7fff7f
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapIDFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2LuXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe

Path C:\Windows\{F5BD8F6A-58B4-4833-8286-5C7CD563DE52}.exe
Size 28KB
SHA256 617ace547eda3230990981703ec2a69dc5be30beef0f2cbe57dfbd6e8b5f9c9d
MD5 5bc5a6e9d5d6faaeed114b6aef7a1732
SHA1 c77e42bd01d56f18017e812e377be19ada7e4f64
SHA512 28dc831116828c32ac831fedb514b4beae67ca3b32b04fcae4521f2cc92ccf9a9d49620219baa9ce76929f0df4c3ccce08adf6a94c5cebbb4325867f65719ac6
SSDEEP 384:2/mPAVyp+6srYYCk2gNPapI7dFpOQGR9zos2clAKLHRN74u56/R9zZwu9n:J4quFCk2L+dXOQ69zbjlAAX5e9zJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-49-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/440-30-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1604-24-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2716-12-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2996-55-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3620-37-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3872-18-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3880-43-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4680-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4680-1-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads