7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
Size 5.7MB
Sample260907-ry63labn4v
SHA256 7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de
MD5 0e3125bd0b88334ecd3da211a8057e84
SHA1 fa3fddb1c86257203f3132a91090eccc14004782
SHA512 6b53bb9d160fce7736786723f40b3381caf22653100baaa5bfb642c2140ca9ad07d90718fde8eeda265532330854c2faa06ddb4bd875a480c5da04fd5198cf73
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZiQgZmPz9BDkcggl:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJZ
TLSH
T13B5623D2786E7AABC10E6CB98D16CE6635AC5BB1C7604C93FFD52DB60810D931733922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WindowsInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	ServiceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WindowsShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	BackgroundTask.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	NetworkHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	SecurityCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	RuntimeBroker32.exe

Deletes itself 1 IoCs

pid	Process
2600	BackgroundTask.exe

Executes dropped EXE 16 IoCs

pid	Process
2600	BackgroundTask.exe
3032	BackgroundTask.exe
1488	NetworkHelper.exe
1068	NetworkHelper.exe
4248	SecurityCore.exe
3428	SecurityCore.exe
2440	WindowsInternal.exe
3200	WindowsInternal.exe
1580	ServiceHost.exe
3648	ServiceHost.exe
4172	RuntimeBroker32.exe
4296	RuntimeBroker32.exe
4144	WindowsShell.exe
3352	WindowsShell.exe
2660	SystemTrayHelper.exe
1232	SystemTrayHelper.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsInternal.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\ServiceHost.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\RuntimeBroker32.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\SystemTrayHelper.exe\""	WindowsShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\BackgroundTask.exe\""	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	BackgroundTask.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\WindowsShell.exe\""	WindowsShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
107	raw.githubusercontent.com
115	raw.githubusercontent.com
130	raw.githubusercontent.com
71	raw.githubusercontent.com
72	raw.githubusercontent.com
106	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x0017000000011d32-12.dat	suspicious_telegram_bot
behavioral1/files/0x000c00000001dae2-78.dat	suspicious_telegram_bot
behavioral1/files/0x000300000001e44e-114.dat	suspicious_telegram_bot
behavioral1/files/0x000300000001e73a-144.dat	suspicious_telegram_bot
behavioral1/files/0x00030000000006ff-197.dat	suspicious_telegram_bot
behavioral1/files/0x0003000000000729-246.dat	suspicious_telegram_bot
behavioral1/files/0x00040000000006ff-280.dat	suspicious_telegram_bot
behavioral1/files/0x00060000000162bc-316.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BackgroundTask.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SecurityCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ServiceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NetworkHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WindowsInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
2600	BackgroundTask.exe
1488	NetworkHelper.exe
1488	NetworkHelper.exe
1488	NetworkHelper.exe
1488	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
1068	NetworkHelper.exe
4248	SecurityCore.exe
4248	SecurityCore.exe
4248	SecurityCore.exe
4248	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
3428	SecurityCore.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
2440	WindowsInternal.exe
3648	ServiceHost.exe
3648	ServiceHost.exe
3648	ServiceHost.exe
3648	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
1580	ServiceHost.exe
4172	RuntimeBroker32.exe
4172	RuntimeBroker32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3032	1456	7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe	99
PID 2600 wrote to memory of 1488	2600	BackgroundTask.exe	101
PID 1068 wrote to memory of 4248	1068	NetworkHelper.exe	105
PID 2440 wrote to memory of 3648	2440	WindowsInternal.exe	114
PID 1580 wrote to memory of 4172	1580	ServiceHost.exe	116
PID 4296 wrote to memory of 4144	4296	RuntimeBroker32.exe	120
PID 3352 wrote to memory of 2660	3352	WindowsShell.exe	128

C:\Users\Admin\AppData\Local\Temp\7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe
"C:\Users\Admin\AppData\Local\Temp\7fd201bdbdfb2efc9cab8f94444fc097acdf52f16e532e0e2d8004ce90a4a2de.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe"
1⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1488

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3428
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:3200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4172

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4144

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2660

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 98b08bf802d3d70ca602982880b93dbb801c895753dba08530d7e48711c3b546
MD5 768e6de192ca683c67c5e614eeb9d0a1
SHA1 c5911d32089d885b4335e20c6f6c7f18fec9e551
SHA512 682b20036b82c777ccc6cce0280675b7a746a5f7193c6d4a5d014dbe2542b460498306b7165672fa33f19e11b9de5f53421c1e1615f86826c1326beeb0d6d4e1
TLSH
T10AE07D12676DC2C862538A248DF4A4B57CA9320F14974288592E77C109156BDD10F11B
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 da2d91573b168c43759a32c155aaa1a9ec6404d49a825507c96782a830aee6dc
MD5 bdfeb16c4c7563a00184c000aedc7067
SHA1 f56dff9d6ea14b0a7db8de01a2b721be74bb1dc1
SHA512 cb9c241209052c51bbf9fe171620d4fa1e72608c6ed2a5531d0ee6c4b3f67bcbee401ee2802b69dd4559915aaa1d97c13abd8373c69e65b1d8c9322574d23196
TLSH
T1D141A5DA7B2C34B5BFC18E448D38C6366E78F2D4D991645624FBC4A36446B812C5A44C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 08a447ef3dd66240110691dc7174d29d4713d55ba3d3dec4176a5d46ce38ef6a
MD5 38883942b39a34806ead8be5151db2c1
SHA1 d1463bff0fef81b3dd244e5e2c9097e8ef88a008
SHA512 f617f80fd886e3acce20d7dbb323d9064774dcc949bb8ee5a8bbcdddaf92e38a7edfb88100c7d79d2b0109714f2bbcea0f6bb0193775d5f4cae6941aa51eecac
TLSH
T131D02B1794F5C4A73912DD0019CDF93075135A7B13D8595A780DA9559D119785F0206C
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 182KB
SHA256 7cd7902337a7519aed50eba26b944c35b2bd1872d1f79ee9f86d701a211f5ad9
MD5 cdbcb4fa635aedaa8b1f7a9a4f0217f9
SHA1 06cea562dec6ba12be550b14f4e3c8ab497b849f
SHA512 dc75506ed1b06f470b7e645f4e60de91f1f204a569ed7c33052c1f8b5ec47ee71ca91a017d8004ff1c16048e384b63ab629830aaab14bd6f26794f13cb402686
SSDEEP 3072:5XOD6UEmIwPx74n/HCQoDdyIGVeNA7tidLBf:5TXHOx7u/YkHVeWBaB
TLSH
T168043BA45C7BB6A35D4BCE524CAEF69612F591D92812732A7E307E505C03ABFDE13C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 40733033c1cbb77c1f524ca34fc162fca7d358f2c2b897d3f8d826ea83c7be58
MD5 468e77b14ab7a8d9c2d6285dc4d270cf
SHA1 464109a45a30bc42bc87cc8b7927378a70f59998
SHA512 03d87cedff009e0a55adbd00e3f96360578130e7caf75a9cf4623c30a277c58d8409c5fa3244cd9c3b76617e829e7902761055ab965b89d694e362bdb786a7c0
TLSH
T1061121C36EF8A18499F39760CAE8C6313CB9608669FA30D11C9198D3205B72C6F1803F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 2f30f612ebe6b5ddf73587f48b3c435fdaf7966644ea9d009a3753063f561e96
MD5 48b31f0c525313935e61c498ebb8e48d
SHA1 b63964b7e3b0f40d541dfb7e88a000495b250ed9
SHA512 6f9bd3256a7e49fbd77cd67019b83026718d9716dad0433457ba756ea3178e621398219a92e9fb2ac685733ce8a5a63d5fca8c1adcda407d599669886be88a21
TLSH
T1D641C9EB1B4D7DA4AF418F8998F4C9362E38D4A991C018827476C4D3249E7852D07C5C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6b9600fad7ee70ed1472610ca3c308bbfd3779ccb1b9410540676fa3e4d3b65c
MD5 b13f89ef4c6b4e452073ecd6914eb3c3
SHA1 d7d859c9446a1ebdcd6d7e9583c32b6021db2027
SHA512 bc1a357de98ba91c32dc3046dc44168182febb6bef5d87b345618d956de9d1b664e76141423bb286ac2e6ce6055b63c7f33f5852decf9d9c43bac68b27c971f4
TLSH
T155C08C2C5AA21A06F2A843BC12C139039B608101E2419F091AF12A08CD96B1A6838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 2fb3fe463b384abf6bcfff3950fa29b2e2791abf095dba72bb14da3162da1d6d
MD5 c1a2d453631008c3b432f8ee34900a28
SHA1 b2087f7d2ce71e50a7c8fd1ed7663f3a31d774ca
SHA512 2c9986234e3f5acfde08f2121901136ce0af84c34a5b51220b27673379ca086ee4d327e1628cfb74150bff570fb0fc3c95552e16aad59fc9f38c63a3b0257494
TLSH
T17FF05C2C16FC506CE032CEF9CBE6A2559D16F117540405EA0ED24B085E06F012C4152E
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 6d2ba48f0df60b1d5626933f1aaaedd10b830564c012bb200dbca459bc2aafb2
MD5 64066d335d211f6dac19c386cf87ec56
SHA1 0f047406b0cbb75448a358247d3a655e429ff72c
SHA512 944e6e65ac833fa12297136f0f0161614f2045430f9f892a961f98a3daf6bd44c5325b77615b27b41bbbd6b56dd0ee75966f77f242045b4545c470ecd01c7887
TLSH
T18DF0686839FF623AF0379D7953C930F04679E218340516B92AF41308AF00F216C4252D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 36f3877a9b9c97019354e41591ba41f56bd626040fd3f8b248e4dca46beb90dd
MD5 cd5e206e26684f5fc28eb0e964cd0527
SHA1 487b95ea2faf9b257cc3e31d4f9b86ef3618e531
SHA512 5866a472549d77295b48caa65e11ebf8716c085b6f49ac4968c9cae6d6fd042a9a29f80274fd1654062c4d5570820da10e579919a3cab2d8146df3d6e8cb3dca
TLSH
T111F0A30425F8405DF0B2F8FCC2E663FADD35F115681959F609D503045B16F011D1192F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 4ce078de5b010cd3396db26be871665a3a77c8ccf93f3087f0cd250bf3f37688
MD5 20f82a497dd542179cf24dc9a962e48f
SHA1 91db02499926dd8573a3208cbf33017bd4ceeab2
SHA512 32a40b50b4b161cb526b335dff1a1a7ba5fc2f0a2818835725f64f0c43ce83b7068c2652b1f7b137a98334f900da90b4deb176f4ed2fa3ee8a9825baea8b802f
TLSH
T186D02228266202A3F073917FE9210AC12FB4A820F1825B6F1F72220C883DF109E51C4C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 76e7283a1cd7d3228430367e3640360a3329d80cf98275afe7adea037a6dcd3c
MD5 31246fc8a9be6510903df01f08958292
SHA1 7af87e9249b6a0719aa1f43c49adc390b4eaa623
SHA512 e14ce2486d4c4a7fb1b853aee8f550a18be6dd288f9221424f524fe55afbf823f91250470713ad538b9211a9df9abd3c36f509e2dab1a25afbf578ebe5ef3336
TLSH
T1B3F05C381992407EE235677A4AE5A7EB8C0DA3523408D46675D1160EF607E415D51479
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 c1dfe6f2a8d69e3d5cf2c644b162465d81a6b748f9d5d1a17ae8cdaf211cbcb3
MD5 e613bb17ccc51994eb8566e5353dfa43
SHA1 587928135fcff68903f8ac644ae55cec57bf7143
SHA512 7e04c616a10722efc32e6fd4bcaa9d5bf542302eacd3e9c6f60d71d1ff1658eaa046629fb30b3ea39a559ddcb49b514b2f1ff111082a4a1ee0454740d4e0d67c
TLSH
T1CEF0AB3435F7002EF151D6FC02C01AC782B2F2373108367E6A718305AD06A40A9A0929
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 26154ffa8020e7624b47c9f3da9ee834daa667ca5a1e61e9c14340534419b7bf
MD5 b1038cf95843c4860c27440b320cf628
SHA1 ee32ac51fc216f1c0c42521ffdae3e01a4cdf3ea
SHA512 282794fb1c159a24b4e7e5200e84283f8984b2c46a7a3c64fd633cae6ffe69a44703c193e933921e92cfdc6a663435eec3bd95e90332dcfbc41ecd6a7c067e7e
TLSH
T1FAC08C2C0661060AF3AC93BC12C229838B20A210F381AF1126B13A08CD75F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 5.9MB
SHA256 6b2f0cdd91cee0ecb1a799c8e21ad630228ba8c5986f427541a203f5337298ee
MD5 66084adcd4ff17c7d42c460eea35bfdc
SHA1 a29303b6bbacab420bb4d298a673da9e47efbec4
SHA512 0b677489c2a556a9dc3a8b55f306e41947665014915d1d1066aba96d81c2c58dd1660ed268cb51141e3d9bc29baf27f26a28dd0d59fe97e9bd5a4270608e1158
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZiQgZmPz9BDkcggFHkIHH:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJJ
TLSH
T1EB5623D2785E7AABC10E6CB98D16CD6635AC5BB1C7604C93FFD52EB60810D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\SystemTrayHelper.exe
Size 6.6MB
SHA256 698c546c7522b9206b42488ec1f17fbef4eac6c607968d429b7ce823ed635dc7
MD5 817bf830e00ee5644b4d03848d0858e3
SHA1 3f0bd15117c9f274a6b0a44ece9da8b4278bbeef
SHA512 8676a26aa4b497a2438f242b7ae18317b75421bfed5c0784b2c0bedd222f47f57ccbddb748258db8a60401d5c14dcc079fb155bad3e7f2eea30396325c8168b1
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLle2CwP:TDpbgBr/4QAMQ/ZmADkeaP
TLSH
T1C56623D2785E6AA7C10E5CB98D0ACE6635AC5BB1C7644CA3FFD52DB60910D931B33C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\RuntimeBroker32.exe
Size 6.4MB
SHA256 0ad8a0c708cb1bd255ad5d27131c12a161f7734596e0f696b54136b78619eed9
MD5 18dbd0d1f36b0cbf9669d93f76957557
SHA1 d029c772b3d561d638e1bad5a8f38acf15a3b4f2
SHA512 0cca24cd3bc8839d5cdc91db2bba99af80b1c69d41de7d4872da8f5029fc4a574fe84fb92bd36beae5f619527917f4a423c6b5db98f27132a02f8579b4dd9113
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLle2s:TDpbgBr/4QAMQ/ZmADkeP
TLSH
T1826623D2785E6AA7C10E6CB98D0ACE6635AC5BB1C7644C93FFD53DB60900D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 6.0MB
SHA256 288e1ddd00dbcdea443cfc77b50215459b6621ea68517caff116ebf8d1580745
MD5 67b9b27148b4a7681b1fb1dd718c8181
SHA1 38af7fc6db199aeaad2ded5bccae51232a530ce9
SHA512 1d37d755d5ce5471017c1000a9f83c74d6e364122589ae3c9a20aa1a3f3cf0d18c7dcd4a7bb83e45a756e4dfdbc349cc2e79598597d5dfeb39ae606cc5b4baf0
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLli:TDpbgBr/4QAMQ/ZmADki
TLSH
T1905623D2785E7AABC10D6CB98D16CE6635AC5BB1C7604C93FFD52EB60810D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\ServiceHost.exe
Size 6.3MB
SHA256 02a2f59cbfa85d71ffaf78f820a41291edee35e35e9bea2e92467b8591951064
MD5 4199f0315f8dd1915d0955c4c5daaa4f
SHA1 4d97399e44f881a4989a8211764e0f9e431487af
SHA512 cc20d4ec3e1483f1d13cc11d5b81b5a83ebbf2965d3814e4a6d5736e114e5871c5006854b5c07adcfb2203142766f93e964831b65fe350f1ba2b5a81ca82ae82
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLleh:TDpbgBr/4QAMQ/ZmADkeh
TLSH
T1DF6623D2785E7AA7C10D6CB98D1ACE6635AC5BB1C7604CA3FFD52DB60900D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\BackgroundTask.exe
Size 5.8MB
SHA256 7657f15ee1a90b1831e609498d64935db44c4fa7c92e3290b1f0ae9defee7ef6
MD5 9e9ce34f5bb015aee45a4d7aa6391c8f
SHA1 e26e2e0aad3f96e330e8e875601a9b26d392a5c1
SHA512 09bd160865e31398d483df07e25ad4a33c944f33d2dbb3fe20ff2c162ae7d2a003a456a3edd6ce230858a2f3ed1dcfaadf04f9c6bde6666e9493357358283d50
SSDEEP 98304:+ebGH420Z1T19p5zGlprrYsfcCJ+S8QAMQPd9TZiQgZmPz9BDkcggFHkk:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJd
TLSH
T13C5623D2786E7AABC10D5CB98D06CE6635AC5BB1C7604C93FFD52EB60810D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsInternal.exe
Size 6.1MB
SHA256 7571a8a250b5b616e26bc833faa807c95e50a83fc0f7c47812ad2fae6dbfddb5
MD5 18db970de6f9e17f8059b30dd83a92eb
SHA1 ce23d273795c76599722be32913b09d979b43e6c
SHA512 57d4606c40352e9e3aceab6d4a93beb1eebefef52cbe897716095d441f9c122f6c75fdb420af96d2af5572fa5cc09afd86887a72ddbebbe4d49f5e698f4d8e50
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLle1:TDpbgBr/4QAMQ/ZmADke1
TLSH
T1985623D2789E7AA7C10D6CB98D06CE6635AC5BB1C7604C93FFD52EB60910D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsShell.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\WindowsShell.exe
Size 6.5MB
SHA256 9d58ead0b71295d96ec28597fd7a4e5f87c282dd73c7c55ffb6f87791acfffea
MD5 4fc4cc4ea81e5069d03076e59215be2b
SHA1 6193dc8198f8aed48057c46b01bdc31cabe68c17
SHA512 837a292f0a505b3325f680bc6695d74a9539e6162d786556aa0c67ed1fd8766ed7fc2891a4144db67506815de1d80c10c1b393a18fd235a048fbab6666c14864
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQ/ZmUPnDJgLle2Cf:TDpbgBr/4QAMQ/ZmADked
TLSH
T1AC6623D2785E6AA7C10E6CB98D1ACE6635AC5BB1C7644C93FFD53DB60800D931B33922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download