c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
Size 1.5MB
Sample260831-ex5rxsef39
SHA256 c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7
MD5 1a1ecbbca72db304b764f912b21addbf
SHA1 2fc6dd1275bfa8547793e2ee8844ab57040d601c
SHA512 4da7b41b436ef55d19a92039da68ec99d098895042f102e053e3aa2be19afb96812a8d1e46121ee06d432433c031dd7fb5f40a7a10f714d9eac6456fad3eb9da
SSDEEP 24576:RVrTZ9YDaDFuMjqFeA9uRy2vcIhZwQUwELm2+lyqYKEP3P8CUtH:RVo2bj7A9uw2vjw7+lyuUHG
TLSH
T17275AF26ABA801FCD1B7D1F48A668503D772784B0731AEDF03D066662F276D44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
3	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
3	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
20	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
19	1792	hesyr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	svchlp1.exe

Executes dropped EXE 14 IoCs

pid	Process
3956	svchlp1.exe
1652	wlrmdr.exe
3372	0pyhgde8.exe
4768	svchlp2.exe
1792	hesyr.exe
1828	tmp5d6e2b57.exe
1240	svchlp3.exe
2712	svchlp4.exe
1624	syshost.exe
3308	hesyr.exe
3952	msedgeupdateyqu.exe
4212	6lda772h.exe
4168	cx3evy7b.exe
3736	svchlp5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hesyr.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Arubis\\hesyr.exe"	hesyr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\msedgeupdateyqu.exe"	svchlp4.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 3740	1240	svchlp3.exe	60
PID 1624 set thread context of 3740	1624	syshost.exe	60
PID 3736 set thread context of 3960	3736	svchlp5.exe	62

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
672	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4244	schtasks.exe
1264	schtasks.exe
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	svchlp1.exe
3956	svchlp1.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3260	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeDebugPrivilege	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeSecurityPrivilege	4768	svchlp2.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3740	RuntimeBroker.exe
Token: SeShutdownPrivilege	3740	RuntimeBroker.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3956	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe	86
PID 3956 wrote to memory of 2264	3956	svchlp1.exe	52
PID 3956 wrote to memory of 3260	3956	svchlp1.exe	56
PID 3956 wrote to memory of 3740	3956	svchlp1.exe	60
PID 3956 wrote to memory of 3960	3956	svchlp1.exe	62
PID 3956 wrote to memory of 4660	3956	svchlp1.exe	79
PID 3956 wrote to memory of 3892	3956	svchlp1.exe	80
PID 3260 wrote to memory of 5016	3260	Explorer.EXE
PID 3956 wrote to memory of 3372	3956	svchlp1.exe	89
PID 4192 wrote to memory of 4768	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe	90
PID 4768 wrote to memory of 1792	4768	svchlp2.exe	91
PID 1792 wrote to memory of 3260	1792	hesyr.exe	56
PID 4768 wrote to memory of 672	4768	svchlp2.exe	92
PID 1792 wrote to memory of 1828	1792	hesyr.exe	96
PID 4192 wrote to memory of 1240	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe	99
PID 1240 wrote to memory of 4244	1240	svchlp3.exe	100
PID 1240 wrote to memory of 3740	1240	svchlp3.exe	60
PID 3260 wrote to memory of 3096	3260	Explorer.EXE
PID 4192 wrote to memory of 2712	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe	104
PID 1624 wrote to memory of 1264	1624	syshost.exe	106
PID 3260 wrote to memory of 2560	3260	Explorer.EXE
PID 3260 wrote to memory of 2568	3260	Explorer.EXE
PID 1624 wrote to memory of 3740	1624	syshost.exe	60
PID 3956 wrote to memory of 4212	3956	svchlp1.exe	114
PID 3956 wrote to memory of 4168	3956	svchlp1.exe	116
PID 4192 wrote to memory of 3736	4192	c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe	118
PID 3736 wrote to memory of 2308	3736	svchlp5.exe	119
PID 3736 wrote to memory of 3960	3736	svchlp5.exe	62

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2264

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe
  "C:\Users\Admin\AppData\Local\Temp\c79077b4fc9116854249fae9456e653e24929f86ded4a7d8e2e899c4467cd3a7.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
    C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\0pyhgde8.exe
      "C:\Users\Admin\AppData\Local\Temp\0pyhgde8.exe"
      4⤵
      Executes dropped EXE
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\6lda772h.exe
      "C:\Users\Admin\AppData\Local\Temp\6lda772h.exe"
      4⤵
      Executes dropped EXE
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\cx3evy7b.exe
      "C:\Users\Admin\AppData\Local\Temp\cx3evy7b.exe"
      4⤵
      Executes dropped EXE
      PID:4168
- - C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
    C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Roaming\Arubis\hesyr.exe
      "C:\Users\Admin\AppData\Roaming\Arubis\hesyr.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\tmp5d6e2b57.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5d6e2b57.exe"
        5⤵
        Executes dropped EXE
        
        PID:1828
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf8ed4ab6.bat"
      4⤵
      Executes a command shell one-liner
      PID:672
- - C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
    C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4244
- - C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
    C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
    C:\Users\Admin\AppData\Local\Temp\svchlp5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2308

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Users\Admin\AppData\Local\Microsoft\syshost.exe
C:\Users\Admin\AppData\Local\Microsoft\syshost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1264

C:\Users\Admin\AppData\Roaming\Arubis\hesyr.exe
C:\Users\Admin\AppData\Roaming\Arubis\hesyr.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Users\Admin\AppData\Roaming\msedgeupdateyqu.exe
C:\Users\Admin\AppData\Roaming\msedgeupdateyqu.exe
1⤵
- Executes dropped EXE
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0pyhgde8.exe

Path C:\Users\Admin\AppData\Local\Temp\0pyhgde8.exe
Size 257KB
SHA256 0b594995b053042d2985260ee4092d9a46705e5f9fa4a482d476a5857714307d
MD5 b828e126346def192551a0917ca9264d
SHA1 c04fff6cb2652d6465ed3b3759225b9d8ba90aa9
SHA512 e649d29f0a8175d2d361ba8edd8f1a7fe1b18e8b2e47d8c7c4edf02e17a76af9b963e6d900c6d35ab0d142bbc5d675310b28762285ea133ee720dd40b3919efa
SSDEEP 3072:RpFyagHeoO59yMNTwIabzeUjymtes8gr6nwZcKtuMq7wORu3ee8/SKoY46PpdNKY:R2aAMNTwIc3jymtes8gOnwZq7wIohbY
TLSH
T1FE446B4A72A90CF8EDB7813CC9525A46E672B81607B0D6EF07A043675F276D09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6lda772h.exe

Path C:\Users\Admin\AppData\Local\Temp\6lda772h.exe
Size 166KB
SHA256 4e63c3722edbebadf421b2155507fb841cc4b65686463ff9d3c813a1ed5de65b
MD5 6bfb8873eccdb125aa6c557f0bf07d19
SHA1 bbf5e879a1552693960958def94a48c3e880a7a0
SHA512 8bd980f83c63a9cd48e35e0d2921a9223ccf66fe0edf1307828f7bad81b08313c3ffd63d3ec9cc72e9eb07836dbedb17c57609fae5e4902b12573d83a424ec13
SSDEEP 3072:yd6/4CsQSODs98mIOWgxwlIFaKAzhDEWxrGvBvHXrb15STd:yJCsDSs98JswWaKAuRR
TLSH
T19CF37C4A73E510FDE1378239C9551905F772782607209BAF07A04BBA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsEdgeUpdate.xml

Path C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml
Size 1KB
SHA256 4d0d424cc706321c6e57f771b9769cedffd4c988f1de597b00efa8a5216e1e1d
MD5 0fd8926f88f3a9b303ac8de56d26e789
SHA1 dce5e5618c3c125321907503444521b98eb40487
SHA512 e99d5262efc86d13a63a01ee532def6cb7a5b6f6d4e5e3e63654b30c806c39fe1db1eead7bb69a8524f3fa145fc8b16d9dd18c2018f76c85338804817cc053bd
TLSH
T17F3144036BFE1209F1F26F5CAABA54215E63BC654C39D46C00AC250CCAF3D62C961BB7
MD5 SHA1 SHA512 TLSH

Submit Download

cx3evy7b.exe

Path C:\Users\Admin\AppData\Local\Temp\cx3evy7b.exe
Size 221KB
SHA256 646019f74712a82d631ae8010024167a9871b7370f89a66485458f90d338faaa
MD5 fffb4a7cd813d9bf65f43bf78b1e92c1
SHA1 867ab9c62bfafc2461e9e44b529b44c9dbdca3a1
SHA512 d800d2ebd2a5aa659e5accc5aedd30dd019b5ce79571b604b650a04686c04adebedcef3e1ad76dfc9d66d451e27e8e206c7a4e3c3ac3b540238b17d10069a856
SSDEEP 6144:N7kmbU5ru+PW8ZFpmx2BALfxUYkRWC00FpAxEsZAUbq:lkUedZF6kVMCWZTbq
TLSH
T1F0246C67B5E85BB9F46FE535C5C62A26D1F2344A0730D39F52B48E961F03732A12D382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp1.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp1.exe
Size 54KB
SHA256 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110
MD5 26b59bc7336133a5e2f3c696584a9cb9
SHA1 bc2f26426ab52186449688d6e56326a4ef65de27
SHA512 6292a2c4e44449cd7f02aebb2b3f3f6c6b9425c851b75946575004a84b075ab9a26dd2cd705b5dbd41d9eaf672217ed7c0e611b6c99bd0190e3a001986085b36
SSDEEP 1536:KP2AunwYLdkqx4sOLsWz129UXMRRpUafq8LECJu:znXfqLsWJ2LRJfq8Lbu
TLSH
T1ED43082653A213B9D9EAC636C9F4533BF1F07542BA26931F0378F6281B73742751CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp2.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp2.exe
Size 212KB
SHA256 933e29899de1ff32f50bf687c38835e4b2d3de29934cb66386948b4befd8e1cb
MD5 c7171b652dca77633dbfe2cb13468055
SHA1 d25eccacd7fd3d84aabf1674ede1a9dc48d26dad
SHA512 081668c2025c9e186a1136a3415b0a4b1bd24e063a06e1f8b921a54e94ebedfcb7dbcc9e970e11a7b861c44283a0525dcd292ea471f1c41727a63a1e47470714
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytD:rCNEN8WENSQefycwhyK2loMxEOryN
TLSH
T138247E6BB5F45BB8F46FE235C9416A26D1B274091B31D38F22B48ED61F13332A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp3.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp3.exe
Size 1.0MB
SHA256 5101af2542f117d364de90661a235d98876c36c4d580888adc4907ad35d44f92
MD5 60f86ad0d27ca0c5c0b5ead2954abe18
SHA1 2f85a691f3ef664d300a6e9973c07c3d7dabe090
SHA512 a84868ea5e8856802766c1e305f3d94cf0fbdbbbbc0df36dca5c86943d535a955f64d4407940eef4c26290d2772dbebe9304869ab2e461f55b9ee1c09fdc3dfd
SSDEEP 24576:rtGCx0FyGBMSJ7T9y1nws4G3KB0QlpDHJPjgm4Cj:rHCyGySJ7T9yws4GaDlHrg8
TLSH
T15635D037F9AD41E8DBADB077246CB680D788BB06AFA770BD2A8E34437456C476465303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchlp4.exe

Path C:\Users\Admin\AppData\Local\Temp\svchlp4.exe
Size 166KB
SHA256 fcbe9f2d0f07f6c40b258228148fb61e94f4dc59962f2fd4e3ed3051d90cfa3b
MD5 b61499aed9660923cde55a2cd3c88cc5
SHA1 8b1260a28e06c9c0c2d5ae48195aab24926901d3
SHA512 ee96b28539d8a6f75a0e3678420f8e764f26ec36a91c07e1b66421bbd2d723ed818a3ed7dd756a0d70aaac8a1c73960f67f1888ca9cfd99750a465af1ba8461d
SSDEEP 3072:btJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvOvHXrbl5STd:bwCszCYJ8OcgsaftB
TLSH
T1FDF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5d6e2b57.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5d6e2b57.exe
Size 221KB
SHA256 fc44acf1436c69d35151589654f7515bc0e22528786339ded0b25969b62c5c56
MD5 78117778407ac463219f2210b6fd307e
SHA1 ec6d7ac1ddb69203d8314a04bd2ab7b97dbc4b8c
SHA512 efbbde861303450d85af2cea927735822e410b45a4c8bfec91c6482442d48eaa9c5265ba484aa247ca5af53b52d2e160f7235f976f9e86b419bca09b0538086a
SSDEEP 6144:/Bbc5FQ8L58ex1Sr3MnXhmZqcUWbGU75JxEzrIl:j8FtxWfKWSWxS0l
TLSH
T181247B6BB1E45BB8E46FE635C9812A26D1F234194B71D78F10B48ED62F07332E62D346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpf8ed4ab6.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpf8ed4ab6.bat
Size 193B
SHA256 347165442dc074c4297bead2645029ef8391ad5a3d23f6c46550b85e2f22d7bb
MD5 69381ace6cd7b4899516404af35a817e
SHA1 f5cf109f0b16b9ecd874bb89e6727a910ecc64de
SHA512 a1c945f01c1965c205614f7da192b0dcb8986b1b5bc9eedd6bd0a83932b249734911f0ac70207e351a6e47b7502d5be2a67b39f10ffc7c2679cff5cfdc10852e
TLSH
T1C0C0124581DACB5E2808517706B9718ED0BA4C983F8B67185F21C44E729641DF5DB382
MD5 SHA1 SHA512 TLSH

Submit Download

hesyr.exe

Path C:\Users\Admin\AppData\Roaming\Arubis\hesyr.exe
Size 212KB
SHA256 8a81f2f86c61a105f6f73cc124c033ae8bfe3b59d14353d9119a058a93092726
MD5 a9b80f4b81bc69dfa219f51c2edf82e0
SHA1 a6ae0e3b7f69860c61710f170b91321483f1ef1b
SHA512 610e417e8a5e1dbba0fe4236837f5c0a14aa3e89e5ca336a04c967c93f3c9787e3fae57d5af2c658c31db1298ce7d6d3fe5a5d9eb986026acdb8ded854da8288
SSDEEP 3072:rS/umYftd1ew8WiRLNSQ94fyU8ImVhyCn26WOFz0lkAPxETc7rRxjytf:rCNEN8WENSQefycwhyK2loMxEOryl
TLSH
T1CE247E6BB5E45BB8F46FE235C9416B26D1B274091B31D38F22B48ED61F13332A22D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-140-0x0000000001840000-0x0000000001858000-memory.dmp

Download

memory/1828-142-0x0000000001660000-0x0000000001682000-memory.dmp

Download

memory/1828-136-0x0000000001870000-0x00000000018DB000-memory.dmp

Download

memory/1828-129-0x0000000000170000-0x0000000000200000-memory.dmp

Download

memory/1828-137-0x00000000018E0000-0x0000000001A36000-memory.dmp

Download

memory/1828-128-0x0000000000660000-0x0000000000929000-memory.dmp

Download

memory/1828-138-0x0000000001830000-0x000000000183C000-memory.dmp

Download

memory/1828-139-0x0000000001A40000-0x0000000001F10000-memory.dmp

Download

memory/1828-131-0x0000000000D10000-0x0000000000DBC000-memory.dmp

Download

memory/1828-134-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Download

memory/1828-141-0x0000000001F10000-0x0000000001F1A000-memory.dmp

Download

memory/1828-135-0x0000000001700000-0x000000000182A000-memory.dmp

Download

memory/1828-133-0x0000000000F20000-0x000000000165F000-memory.dmp

Download

memory/1828-132-0x0000000000EC0000-0x0000000000F15000-memory.dmp

Download

memory/1828-143-0x00000000016C0000-0x00000000016EB000-memory.dmp

Download

memory/1828-144-0x0000000001F40000-0x0000000001FDE000-memory.dmp

Download

memory/1828-145-0x0000000001FE0000-0x000000000207B000-memory.dmp

Download

memory/1828-146-0x0000000002080000-0x00000000021AA000-memory.dmp

Download

memory/1828-147-0x00000000021B0000-0x00000000022B0000-memory.dmp

Download

memory/1828-130-0x0000000000B00000-0x0000000000CA1000-memory.dmp

Download

memory/1828-127-0x00000000005A0000-0x000000000065E000-memory.dmp

Download

memory/2264-16-0x0000018E35C30000-0x0000018E35C32000-memory.dmp

Download

memory/3260-76-0x0000000002440000-0x0000000002481000-memory.dmp

Download

memory/3260-28-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3260-75-0x0000000002440000-0x0000000002481000-memory.dmp

Download

memory/3260-74-0x0000000002440000-0x0000000002481000-memory.dmp

Download

memory/3260-73-0x0000000002440000-0x0000000002481000-memory.dmp

Download

memory/3260-44-0x00000000024B0000-0x00000000024B1000-memory.dmp

Download

memory/4192-42-0x0000024DC61E0000-0x0000024DC6220000-memory.dmp

Download

memory/4192-56-0x00007FF7E0BA0000-0x00007FF7E0D34000-memory.dmp

Download

memory/4192-35-0x0000024DC4B30000-0x0000024DC4B38000-memory.dmp

Download

memory/4192-37-0x0000024DC4D80000-0x0000024DC4DB8000-memory.dmp

Download

memory/4192-38-0x0000024DC4D50000-0x0000024DC4D5E000-memory.dmp

Download

memory/4192-118-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-4-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-12-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-66-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-65-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-64-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-2-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-3-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4192-0-0x00007FF7E0BA0000-0x00007FF7E0D34000-memory.dmp

Download

memory/4192-1-0x0000024DA63E0000-0x0000024DA641A000-memory.dmp

Download

memory/4192-126-0x0000024DBEE10000-0x0000024DBEE20000-memory.dmp

Download

memory/4768-102-0x0000000001880000-0x00000000018B1000-memory.dmp

Download

memory/4768-91-0x0000000001F20000-0x00000000023F0000-memory.dmp

Download

memory/4768-92-0x0000000001860000-0x000000000186A000-memory.dmp

Download

memory/4768-90-0x0000000001A60000-0x0000000001BB6000-memory.dmp

Download

memory/4768-89-0x00000000018C0000-0x000000000192B000-memory.dmp

Download

memory/4768-88-0x0000000001690000-0x00000000017BA000-memory.dmp

Download

memory/4768-86-0x0000000000560000-0x0000000000568000-memory.dmp

Download

memory/4768-82-0x0000000000C70000-0x0000000000E11000-memory.dmp

Download

memory/4768-94-0x00000000017E0000-0x0000000001802000-memory.dmp

Download

memory/4768-97-0x0000000001BC0000-0x0000000001C5B000-memory.dmp

Download

memory/4768-95-0x0000000001810000-0x000000000183B000-memory.dmp

Download

memory/4768-85-0x0000000000F30000-0x000000000166F000-memory.dmp

Download

memory/4768-87-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/4768-80-0x00000000006D0000-0x0000000000999000-memory.dmp

Download

memory/4768-84-0x0000000000ED0000-0x0000000000F25000-memory.dmp

Download

memory/4768-83-0x0000000000E20000-0x0000000000ECC000-memory.dmp

Download

memory/4768-81-0x0000000000170000-0x0000000000200000-memory.dmp

Download

memory/4768-79-0x0000000000450000-0x000000000050E000-memory.dmp

Download

memory/4768-96-0x0000000001980000-0x0000000001A1E000-memory.dmp

Download

memory/4768-93-0x00000000017C0000-0x00000000017D8000-memory.dmp

Download

memory/4768-98-0x0000000001D90000-0x0000000001EBA000-memory.dmp

Download

memory/4768-99-0x0000000001C60000-0x0000000001CFD000-memory.dmp

Download

memory/4768-101-0x00000000026F0000-0x0000000002A45000-memory.dmp

Download

memory/4768-110-0x00000000025B0000-0x00000000025BC000-memory.dmp

Download

memory/4768-103-0x00000000023F0000-0x00000000024FB000-memory.dmp

Download

memory/4768-104-0x0000000001930000-0x0000000001949000-memory.dmp

Download

memory/4768-105-0x0000000001950000-0x000000000195C000-memory.dmp

Download

memory/4768-106-0x0000000001A30000-0x0000000001A60000-memory.dmp

Download

memory/4768-107-0x0000000001D60000-0x0000000001D78000-memory.dmp

Download

memory/4768-108-0x0000000002540000-0x0000000002574000-memory.dmp

Download

memory/4768-109-0x0000000002580000-0x00000000025A7000-memory.dmp

Download

memory/4768-112-0x0000000004660000-0x0000000004DF0000-memory.dmp

Download

memory/4768-100-0x00000000025F0000-0x00000000026F0000-memory.dmp

Download

memory/4768-113-0x00000000025C0000-0x00000000025EC000-memory.dmp

Download

memory/4768-115-0x0000000004DF0000-0x0000000004E9D000-memory.dmp

Download

memory/4768-116-0x0000000004EA0000-0x0000000004ED3000-memory.dmp

Download

memory/4768-111-0x00000000041F0000-0x0000000004273000-memory.dmp

Download