1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
Size 9.3MB
Sample260827-snretswtbx
SHA256 1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3
MD5 0e1b67e1d68ea274efa3925e719ceda4
SHA1 6659e31af9451073770cbfedcd99f014e75916ea
SHA512 b5e6786baf5692c8e9a2f02f884f1af1172d7a9fb84ade850c5c68e3e1052c306b445431da1025da635938f02fec72ee28a8a6fb3875a24e09ff9b0940dafda2
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcy:TDpbgBr/4QAMQMrEGRHsww7Q8Reecy
TLSH
T191A633E6785F2ABBC10D1C798D16CD22396C57B1CB545CA3EFD53EB60910C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	UserSession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WindowsShell.exe

Deletes itself 1 IoCs

pid	Process
1736	WindowsInternal.exe

Executes dropped EXE 16 IoCs

pid	Process
1736	WindowsInternal.exe
3388	WindowsInternal.exe
2660	NetworkHelper.exe
4156	NetworkHelper.exe
3788	ServiceHost.exe
5100	ServiceHost.exe
4856	SecurityCore.exe
3488	SecurityCore.exe
3612	UserSession.exe
4032	UserSession.exe
3440	WindowsShell.exe
4588	WindowsShell.exe
4740	ServiceHost.exe
5116	ServiceHost.exe
3036	WindowsShell.exe
5052	WindowsShell.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\NetworkHelper.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\ServiceHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\WindowsInternal.exe\""	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UserSession.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\WindowsShell.exe\""	UserSession.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ServiceHost.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
83	raw.githubusercontent.com
109	raw.githubusercontent.com
115	raw.githubusercontent.com
123	raw.githubusercontent.com
68	raw.githubusercontent.com
82	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0007000000024526-4.dat	suspicious_telegram_bot
behavioral1/files/0x0008000000024527-72.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002452f-108.dat	suspicious_telegram_bot
behavioral1/files/0x000700000002453f-163.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000723-198.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000725-240.dat	suspicious_telegram_bot
behavioral1/files/0x0004000000000723-275.dat	suspicious_telegram_bot
behavioral1/files/0x0005000000000725-311.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserSession.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UserSession.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
1736	WindowsInternal.exe
1736	WindowsInternal.exe
1736	WindowsInternal.exe
1736	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
3388	WindowsInternal.exe
4156	NetworkHelper.exe
4156	NetworkHelper.exe
4156	NetworkHelper.exe
4156	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
2660	NetworkHelper.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
3788	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
5100	ServiceHost.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
4856	SecurityCore.exe
3612	UserSession.exe
3612	UserSession.exe
3612	UserSession.exe
3612	UserSession.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1736	4172	1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe	94
PID 3388 wrote to memory of 4156	3388	WindowsInternal.exe	100
PID 2660 wrote to memory of 3788	2660	NetworkHelper.exe	101
PID 5100 wrote to memory of 3488	5100	ServiceHost.exe	107
PID 4856 wrote to memory of 3612	4856	SecurityCore.exe	109
PID 4032 wrote to memory of 3440	4032	UserSession.exe	111
PID 4588 wrote to memory of 4740	4588	WindowsShell.exe	114
PID 5116 wrote to memory of 3036	5116	ServiceHost.exe	117

C:\Users\Admin\AppData\Local\Temp\1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe
"C:\Users\Admin\AppData\Local\Temp\1a47e3fff4d5d9f68e97510842636a35af6a09ba6aa714008fc73b157eae53f3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe" --monitor
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3612

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3440

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4740

C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Temp\\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3036

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
Size 282B
SHA256 55fc8e1cdf129ad0a0206ec4abb9519e7ad53b812897eb11a2c62d6bb15f62c3
MD5 bc7468705f79afa8503bb51682f2b8c3
SHA1 d1ad73df3213f4e1ef816b66105eb7106ba453a1
SHA512 62b0d1b157602c7e2d3b0254567d6ea446d1d92bba31e09ac4054e612e9d2392737ff3779f65fa9ab85485231485f45a7a3e24fbd1ed6fed7e33e7938eb64e13
TLSH
T1DFD02B46A9BBA412BE72D99044D1F530740124B215E029323C2C8AAAA930569D707D64
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 904f027556859d0caa06473460b4eeeee714f560005386ee44bbe52520f9ea81
MD5 6dbdb632e239e3863d2ec007c70088a0
SHA1 953967b927e714169f819cc9272a031113efee20
SHA512 88e45853c4c4d4428abec2737994a84fb015e6de19760e6dc257b496a3615b0bbc90af76e826e44520ed745df33761286ae310c05bd1a77c9a986e6671e86b92
TLSH
T1B541A9D66F193425BF46CFC54974CB373E7CB0D48945206669FA887230D6BD12D6788C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 179KB
SHA256 9d56de01b91ea21d61b0b0de9d4057e6025bc9d720d1e397dbb3695be54decf9
MD5 fce64be9e1cd6929846696879e49b21a
SHA1 e222b7c31d70b3e091170aa80a0e2a20b8d736ef
SHA512 1a2c9857ca6dd51916e8c396917bb54ca9eb04ef24599185868977a7c426ee68019f122362ccb1b9f6b9687b6dc5843029764dc22e96b01063e056ccd778b5ed
SSDEEP 3072:16xn47QHP35Bgj67IYHn4G/5m7JnslMDhjDi:16yUHP8GsCn4G/QsCDhXi
TLSH
T1DB041BA45C3BB6A3AD07CF524DAEB69612E591C52912732E3E347E505C13ABFDB13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 38aa5bce7a12e1205b431da44b2af2d748d12007e1c896f72699cb5df09ed934
MD5 65e2fdc549f7e536b70bbba7354f6ca7
SHA1 b31742fd1db607d248323384355423d57d2493dd
SHA512 4087e6d471ea1bb8b9a294dc4efe8073ed54491f74c2411dfe8894587df7465479e09161e71e189e4495d359dc00761ae533f43d23fd561c8145a4cc9f8e2c28
TLSH
T1E21121C66EA4F19186E7ABA0CBF8C6357C7820C62CEE34D118938493249B72C6B1543F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 c60444ca82411cd85099952b22e8a0da4f07b5643d9c2da3fc8bf6c4d6a67595
MD5 d67280fdb96a5c391309f03119a0960d
SHA1 e1bbbaa58a9fa2328cf9107a7ac5e76d3994a0e6
SHA512 0b74436a3263951e116237895992a32220110a7882ed1418eb801598835408a6220724b344942ff6db29cf0b97b29e4a76e1db9a32cfa5039fcea771d758b094
TLSH
T169411AF71F087968BF42CF8B5DE6CA3B1D3890A462C80241B473C5D200EE3456F1A94C
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECD6FDADF7B82585744D7D2C692CBD2B
Size 369B
SHA256 59e054ee9490a40ce49344bb4060330b597a4ed5a5e83659414992eb87eca2ef
MD5 0b52e20e64ef86c028ac1cd4a3969b15
SHA1 1dee1f827e8d0c331f7983cc442d1b32d2902730
SHA512 cd98a22baaabec9d2a857856b9b3b529a5d47fe9831d443f83724c7bd54c6e7a6d0f4e26ed6cbb7f7e537c9af6c2c71089c6bc8487c0b507c1dea41079088446
TLSH
T1F9E0F19712106681D1D2C86D42C1E8472DB020890B84E015991045830867FD5F28301A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09EC553619BC82A45E441B5D9BEB4136

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
Size 488B
SHA256 a17374fde9c66a84a37218f274ae228e20e98000c98bcd2f49037b2d203394af
MD5 7b58c8316737c99183e8015016b00240
SHA1 af5a446cefa373f48d2dc11f0bba072c94cec3ca
SHA512 cef12c0afdd4afcc0771914bde13cba48e2579d021677c5d5868ad982a2b825f07211bffc84887ee32a5e8e1d1252745a88c50ed8cad65ca74031fd197983922
TLSH
T11EF0A31434BC8318D072DCBDD6E472AAB516F1053848DAB61D57460697079415D59E3D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1df7feb9c4f01a81fd491c4d6631da64fd222cb8f457712ac134d7f3918a4760
MD5 57e8da5b09d6fe46ae8a34e550182a7b
SHA1 858240871cdb9a1c2bcd07642101b1a51aba23f3
SHA512 92cf2c618760eb09a3b1d3c798a7e1de392933bf181fcb4eac12c05d85e6b0d98888e4e2a4fa86b07e9ef4d0bd7ed82d5d63c1c0aaec9ee703c25e85f12e008b
TLSH
T1E5C08C1C1AA25A06F2E8437C12C23913AB208101E2458F051BF22A08C996B262878C3A
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 582adaaffc626be5e0e3d5d02a10fb5acd748171c0a6f2560ce4b9225f25e810
MD5 74a8735a8ea0b1ff307778e0137ac394
SHA1 f781298d94890a3b4b225765c6f5282f0a7a95e5
SHA512 6db25a261296bb375a2fb3c6075e90fc05d8a33c47d8430f6199a2d0e9eaa751565a18b61e7f1fe6b4493778555efa1412cc698e4983311d2d2ae7c17611fed8
TLSH
T141F068B93EFE913BF0BAF93943C9B0700925F30760096A7A26F10708AA11E103C45A0F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 ded71792f3f74ced88a426d65b1a2863b9b72e454c0fe2aca686b2d02120a341
MD5 4390bca67eda98609aeb304a0b519018
SHA1 44fdd087ebb3c15a16f2c248fc0682cbfa4be92e
SHA512 5bff6d635e587f3ef9cfb7ef6add999868adf880db7511bbd134eff2008a6cbcd3af6dadc9210ca006f8a6f00da4c3e1c14e16dc2e417fdbc3c3fcb3e732b449
TLSH
T1CBD0222C1F92023AF41897BD883405806F307910F2634B2C0FB0000D48BEE822C11C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 f0728622bd238cabec060a9ade20170a56091899fc2bbffcbd1408672ce85c08
MD5 440be2603791da79f16996e5eab8fe39
SHA1 00edfa5c425084a0eb8d55bf36c0ad1143ce6174
SHA512 bca78888cca065edb3c4832f2300a532699247ea3915a827437dedddf1838bfa6813516321541c0e19987fb29cc4f1c599a65bdfe07a7d77db34ab7be24da4a2
TLSH
T10BF0553D0692416EF231A7344AE893AA991AE2973408CC702AE20B0AFF06B406C1193C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 83774f3a1badb6f3ac86fe58fe1148a9e7fc33dacee1ffcf10cd3f136b6fbba4
MD5 601efdc85af553fd9f75a46bc317d3ce
SHA1 585a97926b47276d90b763e375c491b23c271c75
SHA512 68bea75a923e10be8cb11fe7f37109cc9e5ed8a8b2c811acb983dbc7c687daafd6d350540e57270237722bacdbcd58951c6c9b92480712ab2f34615bb76684de
TLSH
T101F0553924E7012EF533D77E42C212C9126BE23B31042A99ABA102062949C81ADB0A1A
MD5 SHA1 SHA512 TLSH

Submit Download

ECD6FDADF7B82585744D7D2C692CBD2B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECD6FDADF7B82585744D7D2C692CBD2B
Size 338B
SHA256 aff4645a2b7db6e7270e9e46c57cd89b59384d53b3af9259a7e75b9e4acdf73c
MD5 f1abf3def57a1e547467eb65da6c6eb9
SHA1 40f309c53aa15dc8dc0330a702172537cf460485
SHA512 cd8adce0470d4f13ebfbf0b184429a3163c470a5e735403602cd0b21238908ada8101798a89ae43814f9a20c4106f7218be53571baea72f7f69620c001258994
TLSH
T117E0C22817F89706E394A679AAF585825D32B91BA509C72E0ED1058E0819F023C6062B
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b7cd3601e5c1129ede7e3b1220e5e91d74120063bfbe6e8c5d7a512d29cd84ca
MD5 a717ee987bd9ec005640ac6339468bbb
SHA1 cade0febcd1e66a2a715e83925d9b125f4a32a48
SHA512 7aa6bd942ea2a2408150dbaa6349d239e9538290124274588fcaa1b3c636a11d84bcd5d9905f670e0ce372768a184a4c50739da3a8e304122cb27f2d8b8a0f73
TLSH
T1AFC08C1C47610606F2A887B802C229839A208110F3919F0526B22A1CCDA8F262834C29
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\ServiceHost.exe
Size 9.6MB
SHA256 be2f698d42b751d7c9a1a54f756d844c09aa525893ac77fe2b5cc4a55347d08c
MD5 5841d37d8d129cb0217a089ddebfe5ce
SHA1 7a2b56c8540fd517b22e56880dc2c36916acd89f
SHA512 d1550c0e3fb0086aa851001fb9635707fc118cb9ebbbb46e958220ef15e123abf68fd4cf451e12b1cf114738981092e9986800d2c2c2f088002d936966520500
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcYS:TDpbgBr/4QAMQMrEGRHsww7Q8ReecYS
TLSH
T1A0A633E67C5F2ABBC10D1C798D16CD22396C57B1CB545CA3EFD53EB60910C932A22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\WindowsShell.exe
Size 10.0MB
SHA256 d583734f7cd70c1f018ea9ed7c82cb6245bb30eb1f8aaaa01798c1e35d864358
MD5 badb2739947985c0836b2674df52302f
SHA1 53dbb891700408395f4c9c6fce1d6aafa0cbefb4
SHA512 b69b92439801ea58a4e2ca94f71af14f4290ea3130f602360833ad10fc2119c71c4c9135b096ba520d14ce6b3cc397321e3e9c6d183a0740e633b00758b3e95a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcY9T:TDpbgBr/4QAMQMrEGRHsww7Q8ReecY9T
TLSH
T15CB633E6785F2A7BD20D1C798D1ACD22396C57B1C7549CA3EFD53DB60910C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Temp\ServiceHost.exe
Size 10.1MB
SHA256 a7911cf5f4db5825ab02c6d9b7236f46b1ffd58a5579c71a3de3436e0f0fba0a
MD5 a35cc513ce3dc3e3d35a8baa5fa85f5d
SHA1 4e51f966edbee07aa681af62c49e73d96a834c2a
SHA512 6b75a085513aeaaac6d516d227cda2ae7578a52269ef079f9d3e84d3b4287722b4372fea4e8a754d071c4b2d0ef20a5a286e5f6178cb0e855c48eb5fd63697b4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcY9x:TDpbgBr/4QAMQMrEGRHsww7Q8ReecY9x
TLSH
T1F6B633E6785F2A7BC20D1C798D5ACD22396C57B1C7545CA3EFD53EB60910C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\WindowsInternal.exe
Size 9.4MB
SHA256 38f8a3064a4782ce2cf3632247235f2cc9837eeef4f80b466536503c08e972f2
MD5 88df07cb26e4cbb5cca7d07b5a73798b
SHA1 da954a4648c09b44e32c4f6c4e7548a6fd3cbaa4
SHA512 a2c92ab76ca749d296dee085b8dcfc1ba54683e275cbde3336e3e6868bff6ff8071d57b15b4849af77de9a98239f3b0f1aea780f03a0ceceac7008a2316b4ba7
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcE:TDpbgBr/4QAMQMrEGRHsww7Q8ReecE
TLSH
T1B2A633E6785F2ABBC10D1C798D16CD22396C57B1CB545CA3EFD53EB60910C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\NetworkHelper.exe
Size 9.5MB
SHA256 013c51e89e61071cbf144d75a7ce2bcd84173cdcc04157afea2610d57cb4f6b2
MD5 e83b82830824991f9c76d3460cc6c750
SHA1 4675f8f2548fbe50cee58b2f953f7ba95fa4f9d3
SHA512 a511ab355e197e1823a2b80a3ec1389805413deca4412481a639ca4df6eb3568a44a36206dd5465e015beea521c953e0c60ff8477da526b1323b283c3fc7c4f1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcW:TDpbgBr/4QAMQMrEGRHsww7Q8ReecW
TLSH
T1ABA633E6785F2ABBC10D1C79CD16CD22396C57B1CB545CA3EFD53EB60910C532A22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 9.7MB
SHA256 c6aa0db354215a71a874f9210525fd4904a435b1d86008044350402c9de4704c
MD5 e3950f1fdba176804d747215e1f63798
SHA1 3510c2b21f6d3cb732b79f9d6a0f6cbd68ade479
SHA512 1ea0e33913497732f96ee427c846f1c0366c1e7f74edd92973080b1b63dccd21681b4d66b90cba104ae05c366f52486b2b5c2a53dfbb93fb0b810c7dc84d59e4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcY9E:TDpbgBr/4QAMQMrEGRHsww7Q8ReecY9E
TLSH
T19DA633E6785F2ABBC20D1C798D1ACD22396C57B1CB545CA3EFD53DB64910C532B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserSession.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UserSession.exe
Size 9.9MB
SHA256 708be44ec44d49122e4b00d6dd8afbdd2b40e38f89a01b58ca5c2d4e168683c4
MD5 167982ffaa85d040b1c86170227e4859
SHA1 0d027465bd31a21a4152d0bc5c93985d776472ca
SHA512 b44367aaef17bd723fb90cad247ec74fc0167c4ce4c530dedc9d0942412cee9145fce9a60ac7a50fd647fde0e8f61f4f6247393a78627043ebd185208e451525
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcY9T:TDpbgBr/4QAMQMrEGRHsww7Q8ReecY9T
TLSH
T1D9A633E6785F2A7BC20D1C798D1ACD22396C57B1D7545CA3EFD53EB60910C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 10.2MB
SHA256 9eef0e075122df63995ff6e6cf1812eca378aaa01fd5feda47012c88f13e8499
MD5 375d89334e462fe8997f8e29b114d9e4
SHA1 643938dea8f161940dd798b6e2db961180c075f5
SHA512 7962b73973d956dd5d9c12909f93e7456a146de5acce261a1dd3f0adfbd1f9abdd153009e114060765af90d21f2fd24e1e6a1c3050d74a20e28b8ad04f7fdf31
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcY9c1:TDpbgBr/4QAMQMrEGRHsww7Q8ReecY94
TLSH
T16BB633E6785F2A7BC20D1C798D5ACD22396C57B1C7545CA3EFD53EB60910C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download