c627594366a00f69a02c00f3044f279b4c6a3da7d5a11c85d028448746ec791c

Analysis

max time kernel
599s
max time network
466s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x29s_core.exe
Size 1.0MB
Sample260620-cnbrdadz7x
SHA256 c627594366a00f69a02c00f3044f279b4c6a3da7d5a11c85d028448746ec791c
MD5 65bfe84bc3ca390d86bce912d9e08a0d
SHA1 7c25de8252defe4e56553e442f1584f5247df8a4
SHA512 252aaf00f2315a37cfd10ae5450d9a69ed7789545594f806128e22bd62b04b4d17da7e98c648470e97f6fd0d1d348e56d8666ec17168420151b7cffc678671be
SSDEEP 24576:/qux99TP2CBOyNS+/kZOuNzDw/jn/Rnkf+YTCwKqh:/X99TP2CBOyNSSNul+LZn5YT
TLSH
T1A3352B57E6A385ECC52FC0748B639772BA30B46946347D2F1E94D7322E20E605B2EB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\X29S = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x29s_core.exe"	x29s_core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
5020	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
2828	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
3844	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5400	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5624	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
5184	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
3480	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe
244	x29s_core.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1052	5020	x29s_core.exe	89
PID 1052 wrote to memory of 5236	1052	cmd.exe	90
PID 2828 wrote to memory of 2000	2828	x29s_core.exe	94
PID 2000 wrote to memory of 1776	2000	cmd.exe	95
PID 3844 wrote to memory of 5988	3844	x29s_core.exe	98
PID 5988 wrote to memory of 6104	5988	cmd.exe	99
PID 5400 wrote to memory of 5548	5400	x29s_core.exe	102
PID 5548 wrote to memory of 3160	5548	cmd.exe	103
PID 5624 wrote to memory of 2568	5624	x29s_core.exe	106
PID 2568 wrote to memory of 5080	2568	cmd.exe	107
PID 5184 wrote to memory of 2664	5184	x29s_core.exe	110
PID 2664 wrote to memory of 6000	2664	cmd.exe	111
PID 3480 wrote to memory of 1836	3480	x29s_core.exe	114
PID 1836 wrote to memory of 4820	1836	cmd.exe	115
PID 244 wrote to memory of 3396	244	x29s_core.exe	118
PID 3396 wrote to memory of 2108	3396	cmd.exe	119
PID 5404 wrote to memory of 5684	5404	x29s_core.exe	122
PID 5684 wrote to memory of 5188	5684	cmd.exe	123
PID 2716 wrote to memory of 4872	2716	x29s_core.exe	126
PID 4872 wrote to memory of 5416	4872	cmd.exe	127
PID 688 wrote to memory of 548	688	x29s_core.exe	130
PID 548 wrote to memory of 2208	548	cmd.exe	131
PID 5748 wrote to memory of 4176	5748	x29s_core.exe	134
PID 4176 wrote to memory of 3412	4176	cmd.exe	135
PID 3164 wrote to memory of 3228	3164	x29s_core.exe	138
PID 3228 wrote to memory of 2632	3228	cmd.exe	139
PID 3292 wrote to memory of 2988	3292	x29s_core.exe	142
PID 2988 wrote to memory of 2572	2988	cmd.exe	143
PID 3700 wrote to memory of 2788	3700	x29s_core.exe	146
PID 2788 wrote to memory of 4240	2788	cmd.exe	147
PID 2076 wrote to memory of 5948	2076	x29s_core.exe	150
PID 5948 wrote to memory of 2836	5948	cmd.exe	151
PID 4516 wrote to memory of 5584	4516	x29s_core.exe	154
PID 5584 wrote to memory of 5288	5584	cmd.exe	155
PID 5728 wrote to memory of 2740	5728	x29s_core.exe	158
PID 2740 wrote to memory of 2556	2740	cmd.exe	159
PID 1608 wrote to memory of 3872	1608	x29s_core.exe	162
PID 3872 wrote to memory of 4600	3872	cmd.exe	163
PID 3556 wrote to memory of 2964	3556	x29s_core.exe	166
PID 2964 wrote to memory of 4888	2964	cmd.exe	167

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5236

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:1776

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6104

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3160

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5080

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:6000

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4820

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2108

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5188

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5416

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2208

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:3412

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2632

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2572

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4240

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2836

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:5288

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:2556

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4600

C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\System32\cscript.exe
    cscript C:\Windows\Temp\x29s.vbs
    3⤵
    PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x29s.vbs

Path C:\Windows\Temp\x29s.vbs
Size 336B
SHA256 f4c3c4f9b161c816ebc85a727724d4057ccb590c5b5b99d0448121bb99fc1b6a
MD5 e859ad339a00acd7fca5a38da936246f
SHA1 9b1b11d0545e18a12358d1e189afe1953bad922a
SHA512 b036dde2fa6d8d06ed1e7206bd7af4c4f6cb321bfde5df35d0daafffa5bb15e3539966e79a251cb05b99b85880a290f934323bc0eeb96406b51238062e96449e
TLSH
T15FE026520D67889788AF370375E223435ED0921C7AB7363A9964DC0C5F9889E8089092
MD5 SHA1 SHA512 TLSH

Submit Download

debug_c2.txt

Path C:\debug_c2.txt
Size 32B
SHA256 30a9803c288926f349739b306655e9281387dfad6c941b84abc41b126608c400
MD5 60d8f89335bd03ecf096523d3d690809
SHA1 99da757e5ff5415a5714d09de3954f5987586e14
SHA512 10f2bb3135ed581f4181764f0c01f40d9c56a5856bbe4f28b57d90b88a51c8cbf1a86ebdfa5339d5ccd1b16d28704707d7066da93662ecdce2b1906c2d2b0ea7
MD5 SHA1 SHA512

Submit Download

debug_load.txt

Path C:\debug_load.txt
Size 21B
SHA256 7a7747c63cdcd7b378d4bb65daeeee5cf701b573029c8f8fa97bb2430aa9b03a
MD5 f9ad507f79b4230f7ce655d09abdbc7a
SHA1 fbed4f288a54999d108e92b6ea0e191621eaed55
SHA512 c7f7b77505461e6db7fdaa430a6829882858641444df4f35055b6150fdb8ca9e6ac6c534b157cdf9c902eda39cd83ce22f61761c9155e8e0678fde7c93e50690
MD5 SHA1 SHA512

Submit Download

debug_loaded.txt

Path C:\debug_loaded.txt
Size 40B
SHA256 7ce4bb478be10f6af96b366a1e3b02e46acd46264000536412492663fbbe3e3f
MD5 25f48643b395f53e0f2d9d98522aef19
SHA1 452baeaa3ed394b9ef80026dfecc311eca3eadf3
SHA512 d8c10428b18952e64d38214323759b208465f5658ae8705c3e4f449f115a22af51c01773c98ee52ef06d676e93e3ee674a2e0d2c23c0b25d8b519fe7118a43eb
MD5 SHA1 SHA512

Submit Download

debug_main.txt

Path C:\debug_main.txt
Size 16B
SHA256 b2ee13dcebf250e402f7a667b61528cb3f4a22a16aa66331dc2b7c41d98df13e
MD5 76b96be130bb2b941c690b3193ee3e46
SHA1 babaeee95f2464116ed19688c61bbf9cc2f72351
SHA512 0c04b0cd2108beceaf7cb53bd10a80cced43bacceb8917e4e405d391a0b029b0469f3d5346c2db18235655a0f48b5cc9ac3ccf48600a0138279596a600acd64d
MD5 SHA1 SHA512

Submit Download

memory/244-83-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/688-118-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/1608-179-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/2076-161-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/2716-107-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/2828-17-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3164-138-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3292-149-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3480-75-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3556-183-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3700-154-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/3844-30-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/4516-167-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5020-8-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5184-63-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5400-41-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5404-96-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5624-53-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5728-173-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download

memory/5748-130-0x00007FF69B970000-0x00007FF69BA7B000-memory.dmp

Download