phorphiex | daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12-02-2025 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Size

2.0MB
MD5

cc8bd47e840a98a8ee43b37608275684
SHA1

263b14b75634c53aa33b0ee108743fcfd8d0e362
SHA256

daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32
SHA512

da32624bd08d85a4db92a1214c5198e0b19b0476b1517ad789dbce4e7500d841c76500766e7ac46605457489244f98764fd7bebc51ac4f410eeebab8e98df2fa
SSDEEP

49152:XPEpksGULjU7cAGVRHxOOonAjZPeDaAVDjzP/V/Oc:XcpkCfUIvVRjoSZCzVmc

Score

10^/10

phorphiex defense_evasion discovery execution loader persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes

mutex
753f85d83d
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Signatures

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000018704-103.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Downloads MZ/PE file 5 IoCs

flow	pid	Process
4	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
15	2384	AFB0.exe
79	3308	2332030527.exe
107	3308	2332030527.exe
107	3308	2332030527.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 42 IoCs

pid	Process
2384	AFB0.exe
2664	C957.exe
2740	C967.exe
1884	CBD7.exe
840	2969121215.exe
2052	3284922998.exe
1828	3023523047.exe
2540	1428024984.exe
884	sysnldcvmr.exe
2008	E428.exe
2804	E429.exe
2608	824012593.exe
1972	1643713053.exe
872	FC97.exe
2812	FC88.exe
608	FC89.exe
2772	FC98.exe
752	2399033176.exe
1208	487733329.exe
3216	1027.exe
3260	1065.exe
3372	1057.exe
3388	1066.exe
3560	10A5.exe
3544	1094.exe
3552	10A4.exe
3568	1056.exe
1660	349917167.exe
3272	1715417320.exe
3464	1728018137.exe
3524	2018718287.exe
3644	3135319306.exe
3768	1224019459.exe
3852	126219665.exe
3928	2602120429.exe
3308	2332030527.exe
4608	1589032410.exe
4620	1589032410.exe
4684	3361328884.exe
4936	2210731297.exe
3912	1286220754.exe
4376	2121011573.exe

Loads dropped DLL 59 IoCs

pid	Process
2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2384	AFB0.exe
2384	AFB0.exe
2740	C967.exe
2664	C957.exe
2740	C967.exe
2664	C957.exe
1884	CBD7.exe
1884	CBD7.exe
1708	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2460	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2008	E428.exe
2008	E428.exe
2804	E429.exe
2804	E429.exe
1356	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1724	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2292	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1480	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
872	FC97.exe
872	FC97.exe
608	FC89.exe
608	FC89.exe
1800	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2540	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2032	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1680	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1720	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2504	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
1876	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2196	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
3216	1027.exe
3216	1027.exe
3260	1065.exe
3260	1065.exe
3372	1057.exe
3372	1057.exe
3388	1066.exe
3388	1066.exe
3560	10A5.exe
3560	10A5.exe
3544	1094.exe
3544	1094.exe
3552	10A4.exe
3552	10A4.exe
3568	1056.exe
3568	1056.exe
884	sysnldcvmr.exe
2812	FC88.exe
2772	FC98.exe
2812	FC88.exe
2772	FC98.exe
3308	2332030527.exe
3308	2332030527.exe
3308	2332030527.exe
3308	2332030527.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	2969121215.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysnldcvmr.exe	2969121215.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	2969121215.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4256	sc.exe
4436	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10A4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2332030527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBD7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2969121215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10A5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFB0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
3912	1286220754.exe
4376	2121011573.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	1286220754.exe
Token: SeDebugPrivilege	4376	2121011573.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2384	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	31
PID 2580 wrote to memory of 2384	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	31
PID 2580 wrote to memory of 2384	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	31
PID 2580 wrote to memory of 2384	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	31
PID 2580 wrote to memory of 2180	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	33
PID 2580 wrote to memory of 2180	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	33
PID 2580 wrote to memory of 2180	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	33
PID 2580 wrote to memory of 2180	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	33
PID 2580 wrote to memory of 2140	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	34
PID 2580 wrote to memory of 2140	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	34
PID 2580 wrote to memory of 2140	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	34
PID 2580 wrote to memory of 2140	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	34
PID 2180 wrote to memory of 2664	2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	36
PID 2180 wrote to memory of 2664	2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	36
PID 2180 wrote to memory of 2664	2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	36
PID 2180 wrote to memory of 2664	2180	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	36
PID 2140 wrote to memory of 2740	2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	37
PID 2140 wrote to memory of 2740	2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	37
PID 2140 wrote to memory of 2740	2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	37
PID 2140 wrote to memory of 2740	2140	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	37
PID 2580 wrote to memory of 1424	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	38
PID 2580 wrote to memory of 1424	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	38
PID 2580 wrote to memory of 1424	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	38
PID 2580 wrote to memory of 1424	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	38
PID 1424 wrote to memory of 1884	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	39
PID 1424 wrote to memory of 1884	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	39
PID 1424 wrote to memory of 1884	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	39
PID 1424 wrote to memory of 1884	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	39
PID 2384 wrote to memory of 840	2384	AFB0.exe	40
PID 2384 wrote to memory of 840	2384	AFB0.exe	40
PID 2384 wrote to memory of 840	2384	AFB0.exe	40
PID 2384 wrote to memory of 840	2384	AFB0.exe	40
PID 2664 wrote to memory of 2052	2664	C957.exe	42
PID 2664 wrote to memory of 2052	2664	C957.exe	42
PID 2664 wrote to memory of 2052	2664	C957.exe	42
PID 2664 wrote to memory of 2052	2664	C957.exe	42
PID 2740 wrote to memory of 1828	2740	C967.exe	41
PID 2740 wrote to memory of 1828	2740	C967.exe	41
PID 2740 wrote to memory of 1828	2740	C967.exe	41
PID 2740 wrote to memory of 1828	2740	C967.exe	41
PID 1884 wrote to memory of 2540	1884	CBD7.exe	44
PID 1884 wrote to memory of 2540	1884	CBD7.exe	44
PID 1884 wrote to memory of 2540	1884	CBD7.exe	44
PID 1884 wrote to memory of 2540	1884	CBD7.exe	44
PID 840 wrote to memory of 884	840	2969121215.exe	45
PID 840 wrote to memory of 884	840	2969121215.exe	45
PID 840 wrote to memory of 884	840	2969121215.exe	45
PID 840 wrote to memory of 884	840	2969121215.exe	45
PID 1424 wrote to memory of 1708	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	46
PID 1424 wrote to memory of 1708	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	46
PID 1424 wrote to memory of 1708	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	46
PID 1424 wrote to memory of 1708	1424	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	46
PID 2580 wrote to memory of 2460	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	47
PID 2580 wrote to memory of 2460	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	47
PID 2580 wrote to memory of 2460	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	47
PID 2580 wrote to memory of 2460	2580	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	47
PID 1708 wrote to memory of 2008	1708	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	48
PID 1708 wrote to memory of 2008	1708	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	48
PID 1708 wrote to memory of 2008	1708	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	48
PID 1708 wrote to memory of 2008	1708	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	48
PID 2460 wrote to memory of 2804	2460	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	49
PID 2460 wrote to memory of 2804	2460	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	49
PID 2460 wrote to memory of 2804	2460	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	49
PID 2460 wrote to memory of 2804	2460	daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe	49

C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
"C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\AFB0.exe
  "C:\Users\Admin\AppData\Local\Temp\AFB0.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\2969121215.exe
    C:\Users\Admin\AppData\Local\Temp\2969121215.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\2332030527.exe
        
        C:\Users\Admin\AppData\Local\Temp\2332030527.exe
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\3361328884.exe
        
        C:\Users\Admin\AppData\Local\Temp\3361328884.exe
        6⤵
        Executes dropped EXE
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\2210731297.exe
        
        C:\Users\Admin\AppData\Local\Temp\2210731297.exe
        6⤵
        Executes dropped EXE
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\1286220754.exe
        
        C:\Users\Admin\AppData\Local\Temp\1286220754.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc delete "WinDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrv" /f
        7⤵
        
        PID:3928
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDrv"
        8⤵
        Launches sc.exe
        
        PID:4256
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrv" /f
        8⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\2121011573.exe
        
        C:\Users\Admin\AppData\Local\Temp\2121011573.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc delete "WinSvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSvcs" /f
        7⤵
        
        PID:4316
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinSvcs"
        8⤵
        Launches sc.exe
        
        PID:4436
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSvcs" /f
        8⤵
        
        PID:4444
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --local-service
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\C957.exe
    "C:\Users\Admin\AppData\Local\Temp\C957.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\3284922998.exe
      C:\Users\Admin\AppData\Local\Temp\3284922998.exe
      4⤵
      Executes dropped EXE
      PID:2052
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --local-control
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\C967.exe
    "C:\Users\Admin\AppData\Local\Temp\C967.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\3023523047.exe
      C:\Users\Admin\AppData\Local\Temp\3023523047.exe
      4⤵
      Executes dropped EXE
      PID:1828
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\CBD7.exe
    "C:\Users\Admin\AppData\Local\Temp\CBD7.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\1428024984.exe
      C:\Users\Admin\AppData\Local\Temp\1428024984.exe
      4⤵
      Executes dropped EXE
      PID:2540
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\E428.exe
      "C:\Users\Admin\AppData\Local\Temp\E428.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\824012593.exe
        
        C:\Users\Admin\AppData\Local\Temp\824012593.exe
        5⤵
        Executes dropped EXE
        
        PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
      "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\FC98.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FC98.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\1589032410.exe
        
        C:\Users\Admin\AppData\Local\Temp\1589032410.exe
        6⤵
        Executes dropped EXE
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\1056.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1056.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\2602120429.exe
        
        C:\Users\Admin\AppData\Local\Temp\2602120429.exe
        7⤵
        Executes dropped EXE
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
      "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\1057.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1057.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\1728018137.exe
        
        C:\Users\Admin\AppData\Local\Temp\1728018137.exe
        6⤵
        Executes dropped EXE
        
        PID:3464
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\FC89.exe
      "C:\Users\Admin\AppData\Local\Temp\FC89.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:608
    - - C:\Users\Admin\AppData\Local\Temp\487733329.exe
        
        C:\Users\Admin\AppData\Local\Temp\487733329.exe
        5⤵
        Executes dropped EXE
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
      "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\1027.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1027.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\349917167.exe
        
        C:\Users\Admin\AppData\Local\Temp\349917167.exe
        6⤵
        Executes dropped EXE
        
        PID:1660
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\1066.exe
      "C:\Users\Admin\AppData\Local\Temp\1066.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\2018718287.exe
        
        C:\Users\Admin\AppData\Local\Temp\2018718287.exe
        5⤵
        Executes dropped EXE
        
        PID:3524
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\E429.exe
    "C:\Users\Admin\AppData\Local\Temp\E429.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\1643713053.exe
      C:\Users\Admin\AppData\Local\Temp\1643713053.exe
      4⤵
      Executes dropped EXE
      PID:1972
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\FC88.exe
      "C:\Users\Admin\AppData\Local\Temp\FC88.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\1589032410.exe
        
        C:\Users\Admin\AppData\Local\Temp\1589032410.exe
        5⤵
        Executes dropped EXE
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
      "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\10A4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10A4.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\126219665.exe
        
        C:\Users\Admin\AppData\Local\Temp\126219665.exe
        6⤵
        Executes dropped EXE
        
        PID:3852
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\1094.exe
      "C:\Users\Admin\AppData\Local\Temp\1094.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\1224019459.exe
        
        C:\Users\Admin\AppData\Local\Temp\1224019459.exe
        5⤵
        Executes dropped EXE
        
        PID:3768
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\FC97.exe
    "C:\Users\Admin\AppData\Local\Temp\FC97.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\2399033176.exe
      C:\Users\Admin\AppData\Local\Temp\2399033176.exe
      4⤵
      Executes dropped EXE
      PID:752
- - C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
    "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\1065.exe
      "C:\Users\Admin\AppData\Local\Temp\1065.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\1715417320.exe
        
        C:\Users\Admin\AppData\Local\Temp\1715417320.exe
        5⤵
        Executes dropped EXE
        
        PID:3272
- C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe
  "C:\Users\Admin\AppData\Local\Temp\daaac938091ba0a74843749afaae6f923c5bddf0e206ed5f5f1d0c6eb987ce32.exe" --frontend
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1876
- - C:\Users\Admin\AppData\Local\Temp\10A5.exe
    "C:\Users\Admin\AppData\Local\Temp\10A5.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\3135319306.exe
      C:\Users\Admin\AppData\Local\Temp\3135319306.exe
      4⤵
      Executes dropped EXE
      PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AFB0.exe

Filesize
10KB

MD5
8ce09f13942ab5bcb81b175996c8385f

SHA1
6fa685d66ac5fff4e9d984dc1903c47a1a6b6cbd

SHA256
757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d

SHA512
11ae4651b3dd55355b2cb7bf2f6b042dea47bb895f898d967d63ee652652c633cc5becf31cb2fd7f8797b238b264195d09d4e08211b797eae29e2a7bb31b277f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
28KB

MD5
637ba5e57de5d5a5d0acb238bcbe0ca0

SHA1
0284ee4023d8c5ef47c0b569600036601288514c

SHA256
02cb0b986125b6a48aa632f64f557ec1d1735226886c35e71ab3f8d20b0a3168

SHA512
b5e2e9e73d6830f6909a322a01c8af7d957a39fdd6304e4f54854d24a48052fd10ac5ecc2a6fcb264a8b6d3ead8ff10854e8d5b1f6aba2f5d481b11323fd1f20

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
30KB

MD5
3729b2d183f027eeb14eb0810dec74af

SHA1
c4280153fe2ec6683d5bed1b2742c97748c25dfd

SHA256
14d2b19d9ddb4993fce3a0e37dc8b49024d00b35812489ab3e3978023e9c084a

SHA512
def368f3cb41ce82f254956de4c36f1501be5a2b1153327b36d6d1f59020b8907e91be8f6f71c2c91c5446c437632f3c84afcf3f931bc4f94f60064443d46e72

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
44KB

MD5
2abeb789516e7a6687c80a52ce0428bb

SHA1
7da506986ae7ee56c8cbc7c8a36092595aae8472

SHA256
bc20647291a1771893d599e3838718b352c376030cb4da955ab122c8f6364111

SHA512
eb9d2b5f0b86e46ed97528a34ad1d8a349ef2b92ecb4fb667819253df73796d09fa2329e401ce115fabc4748cd2a72ac4f2c414a826975ffeb8f8479cf044c98

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
7KB

MD5
1112a9dcf4ccecd02a6d70879444009c

SHA1
11e59ae142e68efc036589e1b81e88dbdb711968

SHA256
aa8ad4482b85a3cf6f71f7dec3effba8cbf13ab7d7822b3cf5af6fcaac32e0cd

SHA512
32ac4bd238b3ba9d8f31db29b1422c4ff94a3055e02243c0fa3e5c9b7226222481515922d0d9316bb6a11aeebd1c7c32dbf4f5fce71d3003123a81af5a0cbd09

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
14KB

MD5
cfc7e48324d775fdd3339a125f7cf22a

SHA1
cf3795ee9df0ec14306918664589b7152bbd1db3

SHA256
8914917584401ab7082b3dceef5845dc6fa0ec69b0800235c4cff1303a6779c3

SHA512
e5fe11c5505402d0572539c962480865ef13c9eb3be8bdc4cad8b04ccd2c0076e13c0764dccfffc5abd63ce2fda9009d93df87df3dbc960d2d774934c0af2b6e

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

Filesize
20KB

MD5
b41b0208c56a3ea1f5aa56db9eefca08

SHA1
d3f35bcd69cf46878c8dcd27cd8fe96d56605798

SHA256
eedb9c2af54113c5693218f206d82e8df0b7c8cf5008a725872fc2fd2fb61f12

SHA512
f297960a470376faf16923a0abd2a6bc1c6d357643ac60c5d181bc189292b3ea71b5e8364987960f33a898a3fad3d06337d65e44baada310759f28545b5be18c

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

Filesize
2KB

MD5
50ce84a1db23a022b776bccb56d831dd

SHA1
7866570b768a931421a2fc70998ccadff57c486c

SHA256
87d96a7c87be7084826511b1e8282898d359f3c659407b0336b25e58ca8345ce

SHA512
ec178066c9a78f6a47168e5e6ce2290c192dd744a6d654b458ba834e96f6a03d076384dfa10c470e4b23b853dc9b988ff41d658c81b5daa87b56f14066c8e30f

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

Filesize
105B

MD5
7402227f8961582d5706f2c534f1db4b

SHA1
ca5ee135e6b5917d9f0d03f0907b1911303c804e

SHA256
1505a46d5f3c27136d828f00d6e2f885fe6161a664bdb9de38ef5b48f442496c

SHA512
1ee10351e35d2ac7e101036d5c25dd8ea0a0931868ce6d3cef1c67a98a625bbeb1c947dcf70abf67648131673d34020838127e4c798e7b9f8840ea6d4949f52a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
107B

MD5
f25e48e1d9e1e1398bc5fbc6885570b8

SHA1
46557c8ebb9236af6c28c9bdd317d1d25749e710

SHA256
0379e6a5dff30a991e0acdb9932cac828eb3e30ca8cc23447a2bc73ae78181db

SHA512
41e61480f5141b6950d7b96f3e4dfcca19bc480e0b11eeebdedaeb266c6e525f41f3d29a3c1c0bf8f17a3c30111d8fba7e269d5fcf84b336bee916e21881acb7

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

Filesize
132B

MD5
123c524682c9ff72ec7924efdb41b28c

SHA1
1e696d9f3e2bf149773186496c7ab9d5df35f9dd

SHA256
e67a68c5e7fa7d227a2fbdd50789472dbbf58471664b1d9b776a579de2757ff6

SHA512
676e5e2c4ff76b1942c1013a7ee9cd88b42424798e07c699c0cb534575bf4f6908366fe9c9a7e17d81e3f2209bf3fd7dd31463cdab5eea5d19475c10c00f696b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
4KB

MD5
6c897b28f826525f59c50c2cb9493d83

SHA1
f8b70078aaf29b430c6da1c706f8bfea3ffcea12

SHA256
25a3fe48d05ad23ed0d00ec83b0ee4849fbe025d57795c82229a31a0c22e72a1

SHA512
2f6ecfadb19bee1f95982337dfd6090742021357f487865333feb5ec959df7e34bcfb58837ca453a12fd1c7cd0f45322bcb47e51567a18a8afaa62b40b33c9dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
4KB

MD5
bb5735897ad4686a8c30f55720cf8c03

SHA1
b740b647733a70a2eb9255b5a02cefbb86d489c5

SHA256
9aeda56dd0dbf654919d7f9716fb3fee765abdc09a48d14fec3c249bb10f70c6

SHA512
2816dc80984b2d8cb3921b89f48f42ae92656278d4bd56454e661ebea39f55b6a7562cdeed95d35ce10d14cf7b44db867c3abfd3f216b26d2ecd223ec111dbf4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms

Filesize
4KB

MD5
2fe947cf6d3e6fceaa3c11c373c02a16

SHA1
5258398f74ee30c3af7dd639b65f6be27400ec11

SHA256
07380c14e3ada0c65f625be5e458c4ea951f6598eed22cf8faef9a15da76956d

SHA512
97ffd4a8e6104cb23046311c2a465ab529a41bc98640559ae6b431ddc96e506de126ff8824c1bddcd403777414486be211702347ae0f7c8ab59b9270cfeaa0e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GR07PZLV32ZLYR1VQKEL.temp

Filesize
4KB

MD5
5db51ac03ad6e00c1a1ba0bc87f7a9fb

SHA1
d83aaa24926c98ac1d69c09e223b866a1d415dc1

SHA256
c11aa0c85240022d8370f801440932cb78b2a67c0e7f31fb4a0981637666ef16

SHA512
c95cc9312f5dcbae6067a901b249810865847da961fc3b1766879937378d836dbeaec97b2c0a8ff555ae21d8b37d9793978f8ff5e94fe485e12849600cf60e21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O0VV63DAXUR4Y2LXQ2HJ.temp

Filesize
4KB

MD5
501e339595eefc67576a10a51de5c452

SHA1
d875576719de6d95478094fa77a30c8dc836030c

SHA256
10fe9a3aae778b3a13d0bca41c9eb55755665cdbc436f8fca9f2473a73497e2b

SHA512
1e4fdfacc24e4937d0e4f185c750927ba472aa7fc4b313c3838f48195368964ffdc3cd908a812537c9f28cf036a2c5d2b938cc4fe4548f30880e15c731cce7a3

Download Submit
\Users\Admin\AppData\Local\Temp\2969121215.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
memory/1356-532-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1424-225-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1424-80-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1480-530-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1680-548-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1708-329-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1720-549-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1724-531-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1800-543-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/1876-550-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2032-546-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2140-45-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2140-224-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2180-41-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2180-551-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2180-455-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2180-223-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2196-544-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2292-533-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2460-330-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2504-547-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2540-545-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2580-8-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2580-137-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/2580-202-0x0000000000404000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download
memory/2580-10-0x0000000000404000-0x0000000000A82000-memory.dmp

Filesize
6.5MB

Download
memory/2580-11-0x0000000000400000-0x0000000000C77DA0-memory.dmp

Filesize
8.5MB

Download
memory/3912-739-0x000000013FE70000-0x000000013FE76000-memory.dmp

Filesize
24KB

Download
memory/4376-764-0x000000013F280000-0x000000013F286000-memory.dmp

Filesize
24KB

Download