Overview

overview

10

Static

static

5

130ec2a59d...1b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/09/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
  • Size 953KB
  • Sample260909-vbabwsch59
  • SHA256 130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 56 IoCs
  • Sets service image path in registry 3 TTPs 28 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 28 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
    "C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6108
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:5864
    • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
      C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
        C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
          C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
          4⤵
          • Drops file in Drivers directory
          • Sets service image path in registry
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
            C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
            5⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:624
            • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
              C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
              6⤵
              • Drops file in Drivers directory
              • Sets service image path in registry
              • Modifies system executable filetype association
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                7⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5628
                • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                  C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                  8⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4500
                  • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                    C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                    9⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4880
                    • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                      C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                      10⤵
                      • Drops file in Drivers directory
                      • Sets service image path in registry
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3768
                      • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                        C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                        11⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Modifies system executable filetype association
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2840
                        • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                          C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                          12⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2588
                          • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                            C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                            13⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Modifies system executable filetype association
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4892
                            • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                              C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                              14⤵
                              • Drops file in Drivers directory
                              • Sets service image path in registry
                              • Modifies system executable filetype association
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:4708
                              • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                15⤵
                                • Drops file in Drivers directory
                                • Sets service image path in registry
                                • Modifies system executable filetype association
                                • Adds Run key to start application
                                • Enumerates connected drives
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1180
                                • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                  C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                  16⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Modifies system executable filetype association
                                  • Adds Run key to start application
                                  • Enumerates connected drives
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2424
                                  • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                    C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                    17⤵
                                    • Drops file in Drivers directory
                                    • Sets service image path in registry
                                    • Modifies system executable filetype association
                                    • Adds Run key to start application
                                    • Enumerates connected drives
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3868
                                    • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                      C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                      18⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Modifies system executable filetype association
                                      • Enumerates connected drives
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3144
                                      • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                        C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                        19⤵
                                        • Drops file in Drivers directory
                                        • Sets service image path in registry
                                        • Modifies system executable filetype association
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4728
                                        • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                          C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                          20⤵
                                          • Drops file in Drivers directory
                                          • Sets service image path in registry
                                          • Modifies system executable filetype association
                                          • Adds Run key to start application
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:952
                                          • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                            C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                            21⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Modifies system executable filetype association
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:2032
                                            • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                              C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                              22⤵
                                              • Drops file in Drivers directory
                                              • Sets service image path in registry
                                              • Modifies system executable filetype association
                                              • Adds Run key to start application
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:6032
                                              • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                23⤵
                                                • Drops file in Drivers directory
                                                • Sets service image path in registry
                                                • Modifies system executable filetype association
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:3452
                                                • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                  C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                  24⤵
                                                  • Drops file in Drivers directory
                                                  • Sets service image path in registry
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5360
                                                  • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                    C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                    25⤵
                                                    • Drops file in Drivers directory
                                                    • Sets service image path in registry
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1748
                                                    • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                      C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                      26⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Modifies system executable filetype association
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4212
                                                      • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                        C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                        27⤵
                                                        • Drops file in Drivers directory
                                                        • Sets service image path in registry
                                                        • Modifies system executable filetype association
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2984
                                                        • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                          C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                          28⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3704
                                                          • C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                            C:\Users\Admin\AppData\Local\Temp\130ec2a59d76bec535b2d6edd3bd5aca4f5acc9b94d287295f6ebc5ba2a7d91b.exe
                                                            29⤵
                                                              PID:1684
    • C:\Users\Admin\Local Settings\Application Data\cftmon.exe
      "C:\Users\Admin\Local Settings\Application Data\cftmon.exe"
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5416
    • C:\Windows\explorer.exe
      Explorer.exe
      1⤵
      • Modifies registry class
      PID:2428

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Browser Extensions

          1
          T1176

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          4
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          2
          T1547.004

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          6
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cftmon.exe
          • Path C:\Users\Admin\AppData\Local\cftmon.exe
          • Size 971KB
          • SHA256 5b9017b44476b419e596d2790052325e683c4e917c7553bec782f0effd185e9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 976KB
          • SHA256 51e1dc0e5234f772e170b10ebadc00ce1c0377a47c25489b6eaa247b5bf3acd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 954KB
          • SHA256 4a3910551c3d3541d7453f07b1b736e48f8a13da4fb36c0fb1c4439111f0aef4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 964KB
          • SHA256 2e51ec96e6e4de1c9ec67e95bbbe52106d7374ab15e7282c6c522ee94bcd9446
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 975KB
          • SHA256 c24c1b3e9828ea7214da38fb16f4adf1f6d4b13caedc144ad0bac95948cac95a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 969KB
          • SHA256 f559059f04513fb9e2bfe471e3d7681035131bb85439c1f51b2be416d6b38489
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 965KB
          • SHA256 c16e5d99115a8fb17aceeae4d9350528fcd2fea6a337ad917b22d8bdf8b62c1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 973KB
          • SHA256 cb8213b74a2cff0f36200f1de3f3c77cfb9039021e0b5d26b32b1954a9d534d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 963KB
          • SHA256 11f5d65e5f8ce27cb412cd12ecba93fac2615d7692a944e4259e718d6897d90f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 974KB
          • SHA256 9780b998e99499bc0c922a6ccede5e5ade3cd3250a92ba728d2ecda6dd5a91eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 956KB
          • SHA256 6f960e6690ba146fd1c13a38ebe6dd7840e1774c119d6b1c8fbae9cc35fdb203
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 971KB
          • SHA256 7926b0a95fec25a7ffa7ee90141528801d2dfa8e4731740db5c8e1fc4a4238d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 982KB
          • SHA256 56938fff60d56112cd4dbf6ad6c5d1c9dbbce5e08ae8360c073538a40fed6440
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 969KB
          • SHA256 f02afe0b368e566d934ed4bcb2b8edd0fdc4dded28307f3ce1be2a408746fbe8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 976KB
          • SHA256 2c8c8c1556277b596e9bd6204df30bb377aaec783db82b0c5c73625a2545e912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 963KB
          • SHA256 850fd0eaf212a9a48aa16a205421797c9455634c588f2ff981e60e018a241afd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 969KB
          • SHA256 01649347377da053e88de8970cd472340040a0dc12658f0933deb4cd82da22f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 955KB
          • SHA256 9c3abf85bd51570658065f786a6ca5657b468a22581670656ed5c8d8164587fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 972KB
          • SHA256 598813ccbf247e1ec5f5af4a22346730daa836997b334d6d4bc388b49ef259cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 975KB
          • SHA256 1c148dd863449c7b3ef4f2df8c1f57541905c45084a0eab90cad0d19e2c66b16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cftmon.exe
          • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
          • Size 970KB
          • SHA256 97ebb63d72e26cb839b450321b513ba2b10961a0960f638e3412526f91f4d3db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 982KB
          • SHA256 df024b98201c58df20ba5b16f061a5ae9bf8ac5bbb3293888488771a1c7ef3e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 974KB
          • SHA256 0cd9017a8eab0f47803f090ba5a7e047082bcb4d01181c227a1b22b26ee3752d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 968KB
          • SHA256 5174062e3e9d3d2fb002fd3daa4e842647f8412d29af6b23ee9ece037f91f662
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 982KB
          • SHA256 ff64cf90cdfc5c0aa851752ce19d2424bfb3fda8d5ab78fee24f7c9e8481a873
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 984KB
          • SHA256 d54a956770b30d0ca6592c5d648de24820795471286ec08162295c213e827558
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 963KB
          • SHA256 c833cb6b659916e7c13a08af1a55671b5161d68a0ac2c098dec017a19a5fec18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 975KB
          • SHA256 f6840fb8cab7ee4631c3b4268329f31fefe65fc092cb4ca688556c685b77e320
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 976KB
          • SHA256 e8a0fede1d40dd9a4e219663a56959d8f1adc537d42b03f72c596d3493523c5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 979KB
          • SHA256 56eed45762bc5ef0b06c489ffc2010205e742115355277ea0f335161e4ec98a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 971KB
          • SHA256 a10deabc1b75551da1efb89eed9044c3ab060e3b899642fcdca673ad439e9fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 984KB
          • SHA256 ace7dce8426e059c0e4633fe4a62f78455e3d9b7fb7d87fdb8188d6b85d058ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 958KB
          • SHA256 103f48047fc24f69a3b6c97724c2e506f1bfe2aa9179d8fc273baebd3e839fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 974KB
          • SHA256 9cf7df8b63f0320efc4902d24862a10cc14f25d83176ca9e47f4f2a6314147eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 982KB
          • SHA256 d0804a60c808e84a1c2ac3136f26d7ef1c73941ff4e1d684c5161c68cc3afdd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 963KB
          • SHA256 37fbebef77313b23c74ff494108d2d40b94c2823ccdae419437dd61659700b45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 979KB
          • SHA256 ae2f030917ba4ac5f97a39140f0fe75720971142b166ede8a2d12eb003a376ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 968KB
          • SHA256 cf35d11ff118fae5ca6e80a28ff95d371eeb40f74ce65a3a320b8e08c9800447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 960KB
          • SHA256 ea8170a84dece1a0d425546ab61f0964a439ce45c50780cd2c02b954a1464a9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 974KB
          • SHA256 98443276009605dbf0b7a1b11e7296df4944bdf974b9f36f25f3e8972c3ebe46
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 963KB
          • SHA256 8f8bc8d651f7088360bc380269389d0ca9cbd63961dd2dec6bcff9265b494c9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spools.exe
          • Path C:\Windows\SysWOW64\drivers\spools.exe
          • Size 974KB
          • SHA256 f533665e23ad60c94620842b06c9c4c5f21091ea1b61f9a804a51800592b8cff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ftp33.dll
          • Path C:\Windows\SysWOW64\ftp33.dll
          • Size 5KB
          • SHA256 708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stop
          • Path \??\c:\stop
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          memory/624-74-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/624-57-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/952-266-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1180-203-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/1748-317-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2032-279-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2424-216-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2588-165-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2840-152-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/2984-335-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3144-241-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3452-299-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3704-344-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3736-47-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3768-139-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3868-228-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/3976-34-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4212-326-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4216-87-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4500-113-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4708-190-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4728-252-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4840-61-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4880-126-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/4892-177-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5360-308-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5416-7-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5416-18-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/5628-100-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/6032-289-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/6108-14-0x0000000010000000-0x000000001010B000-memory.dmp
          Download

          memory/6108-22-0x0000000010000000-0x000000001010B000-memory.dmp
          Download

          memory/6108-21-0x0000000000400000-0x0000000000430000-memory.dmp
          Download

          memory/6108-0-0x0000000000400000-0x0000000000430000-memory.dmp
          Download