7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe
Size 13.4MB
Sample260706-pypr7sft6w
SHA256 7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23
MD5 93175afb5bb4ac5c75741f98bf6a1c26
SHA1 0b93fad4be186dbcdbbb25ca966c3ec0d28a4395
SHA512 ebbcae5299c5a5500aa9d381ed22d4b45cb994812e7c655e7276a4c4b292fa374d94cdd72606ad2606a8dc561aa910a897a7ec4372c5a7de0ff2d8a524a783d5
SSDEEP 393216:cAfs/4yWVh55wk+d5Fn+9bF7btkRP2T1G+EIrF:11VX2d5F+9thk5l+rR
TLSH
T13CE6333BF18B653EE42A16367972D600893BBB6065168C1297ECF88CCF755701D3EA87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1936	sc.exe
2940	sc.exe
4440	sc.exe
2356	sc.exe
4504	sc.exe
1536	sc.exe
1108	sc.exe
3992	sc.exe
2812	sc.exe
2352	sc.exe
4740	sc.exe
3320	sc.exe
1560	sc.exe
4068	sc.exe
4912	sc.exe
2688	sc.exe
2068	sc.exe
5000	sc.exe
4992	sc.exe
1532	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3720-0-0x0000000000280000-0x0000000000369000-memory.dmp	innosetup
behavioral1/memory/3720-7-0x0000000000280000-0x0000000000369000-memory.dmp	innosetup

Kills process with taskkill 20 IoCs

defense_evasion

pid	Process
4748	taskkill.exe
4704	taskkill.exe
3308	taskkill.exe
2512	taskkill.exe
4652	taskkill.exe
2684	taskkill.exe
3264	taskkill.exe
4296	taskkill.exe
3148	taskkill.exe
3912	taskkill.exe
4912	taskkill.exe
3008	taskkill.exe
4160	taskkill.exe
2260	taskkill.exe
2180	taskkill.exe
3684	taskkill.exe
4332	taskkill.exe
2568	taskkill.exe
1116	taskkill.exe
3992	taskkill.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	4296	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	3912	taskkill.exe
Token: SeDebugPrivilege	3992	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1484	3720	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe	85
PID 1484 wrote to memory of 4748	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	86
PID 1484 wrote to memory of 4296	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	89
PID 1484 wrote to memory of 4160	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	91
PID 1484 wrote to memory of 4704	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	93
PID 1484 wrote to memory of 3308	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	95
PID 1484 wrote to memory of 4332	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	98
PID 1484 wrote to memory of 2512	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	100
PID 1484 wrote to memory of 1936	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	102
PID 1484 wrote to memory of 976	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	104
PID 976 wrote to memory of 3992	976	cmd.exe	106
PID 976 wrote to memory of 3768	976	cmd.exe	107
PID 1484 wrote to memory of 3372	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	108
PID 3372 wrote to memory of 4912	3372	cmd.exe	110
PID 3372 wrote to memory of 4292	3372	cmd.exe	111
PID 1484 wrote to memory of 2812	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	112
PID 1484 wrote to memory of 2644	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	114
PID 2644 wrote to memory of 2940	2644	cmd.exe	116
PID 2644 wrote to memory of 2472	2644	cmd.exe	117
PID 1484 wrote to memory of 2688	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	118
PID 1484 wrote to memory of 748	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	120
PID 748 wrote to memory of 2068	748	cmd.exe	122
PID 748 wrote to memory of 1268	748	cmd.exe	123
PID 1484 wrote to memory of 1060	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	124
PID 1060 wrote to memory of 2352	1060	cmd.exe	126
PID 1060 wrote to memory of 2440	1060	cmd.exe	127
PID 1484 wrote to memory of 4740	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	128
PID 1484 wrote to memory of 3168	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	130
PID 3168 wrote to memory of 4440	3168	cmd.exe	132
PID 3168 wrote to memory of 2620	3168	cmd.exe	133
PID 1484 wrote to memory of 2568	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	134
PID 1484 wrote to memory of 3148	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	136
PID 1484 wrote to memory of 2260	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	138
PID 1484 wrote to memory of 3320	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	140
PID 1484 wrote to memory of 4196	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	142
PID 4196 wrote to memory of 5000	4196	cmd.exe	144
PID 4196 wrote to memory of 4252	4196	cmd.exe	145
PID 1484 wrote to memory of 2224	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	146
PID 2224 wrote to memory of 2356	2224	cmd.exe	148
PID 2224 wrote to memory of 5004	2224	cmd.exe	149
PID 1484 wrote to memory of 4504	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	152
PID 1484 wrote to memory of 4924	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	154
PID 4924 wrote to memory of 1560	4924	cmd.exe	156
PID 4924 wrote to memory of 1544	4924	cmd.exe	157
PID 1484 wrote to memory of 2180	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	158
PID 1484 wrote to memory of 1116	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	160
PID 1484 wrote to memory of 4652	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	163
PID 1484 wrote to memory of 2684	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	165
PID 1484 wrote to memory of 3912	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	167
PID 1484 wrote to memory of 3992	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	169
PID 1484 wrote to memory of 4912	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	171
PID 1484 wrote to memory of 3684	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	173
PID 1484 wrote to memory of 3008	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	175
PID 1484 wrote to memory of 3264	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	177
PID 1484 wrote to memory of 1536	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	179
PID 1484 wrote to memory of 3288	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	181
PID 3288 wrote to memory of 4992	3288	cmd.exe	183
PID 3288 wrote to memory of 3608	3288	cmd.exe	184
PID 1484 wrote to memory of 4740	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	185
PID 4740 wrote to memory of 1108	4740	cmd.exe	187
PID 4740 wrote to memory of 2420	4740	cmd.exe	188
PID 1484 wrote to memory of 4068	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	190
PID 1484 wrote to memory of 3808	1484	7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp	192
PID 3808 wrote to memory of 1532	3808	cmd.exe	194

C:\Users\Admin\AppData\Local\Temp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe
"C:\Users\Admin\AppData\Local\Temp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\is-2GUVGGMPWN.tmp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2GUVGGMPWN.tmp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp" /SL5="$5011A,12881589,893952,C:\Users\Admin\AppData\Local\Temp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "Main.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "update.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "backup-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "dns-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "proxy-third.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "aprocessbak.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "gld-proxy-service.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\SysWOW64\sc.exe
    "sc" stop "ThirdPartyBackupService"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "ThirdPartyBackupService" 2>&1 | findstr /C:"STOPPED" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\SysWOW64\sc.exe
      sc query "ThirdPartyBackupService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3992
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"STOPPED"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "ThirdPartyBackupService" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\sc.exe
      sc query "ThirdPartyBackupService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
- - C:\Windows\SysWOW64\sc.exe
    "sc" delete "ThirdPartyBackupService"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "ThirdPartyBackupService" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\sc.exe
      sc query "ThirdPartyBackupService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2940
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
- - C:\Windows\SysWOW64\sc.exe
    "sc" stop "AutoCopyBackup"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "AutoCopyBackup" 2>&1 | findstr /C:"STOPPED" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\sc.exe
      sc query "AutoCopyBackup"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2068
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"STOPPED"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "AutoCopyBackup" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\sc.exe
      sc query "AutoCopyBackup"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2352
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
- - C:\Windows\SysWOW64\sc.exe
    "sc" delete "AutoCopyBackup"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "AutoCopyBackup" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\SysWOW64\sc.exe
      sc query "AutoCopyBackup"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4440
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "proxy-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "dns-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "gld-proxy-service.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    "sc" stop "WinDivert"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3320
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"STOPPED" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5000
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"STOPPED"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2356
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
- - C:\Windows\SysWOW64\sc.exe
    "sc" delete "WinDivert"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1560
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "Main.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "update.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "backup-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "dns-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "proxy-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "aprocessbak.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "gld-proxy-service.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "proxy-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "dns-third.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM "gld-proxy-service.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\SysWOW64\sc.exe
    "sc" stop "WinDivert"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"STOPPED" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"STOPPED"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1108
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
- - C:\Windows\SysWOW64\sc.exe
    "sc" delete "WinDivert"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C sc query "WinDivert" 2>&1 | findstr /C:"1060" > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Windows\SysWOW64\sc.exe
      sc query "WinDivert"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"1060"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2GUVGGMPWN.tmp\7fbaa309ee3f237aa66b12cc83e1b63bf36d542682dada2efc56b7cc17fcde23.tmp
Size 4.2MB
SHA256 91a602b26b741aa76a0437fcb67dd7feb53e5cef23a4cb957cef29f4a2be9b45
MD5 e7c478274cd8eea1cdd635c08bcdefe3
SHA1 7cf44a1c2028b98ad72cb8eb3a8317e281069097
SHA512 dbb160f286c804cfe936f41193e5bd6f8e000f72b4160ba4e05fe117651bbb83ba4c48a2a289605b771718f7ad2438ced2664929a4d5783f416d3d5535b7e934
SSDEEP 98304:z9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jc333PK:IItJj90Z6RgKwNK
TLSH
T1C6268F03F388753EE4A71A3A883FA254583F7A213916CD476BFC295C4F396416D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-5-0x00000000019C0000-0x00000000019C1000-memory.dmp

Download

memory/1484-9-0x00000000019C0000-0x00000000019C1000-memory.dmp

Download

memory/1484-8-0x0000000000210000-0x000000000065C000-memory.dmp

Download

memory/1484-11-0x0000000000210000-0x000000000065C000-memory.dmp

Download

memory/1484-13-0x0000000000210000-0x000000000065C000-memory.dmp

Download

memory/3720-0-0x0000000000280000-0x0000000000369000-memory.dmp

Download

memory/3720-7-0x0000000000280000-0x0000000000369000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads