560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Size 167KB
Sample260910-xk3e5sec69
SHA256 560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b
MD5 feb723123dfeff7734395d9a4df4f8dc
SHA1 a5dffee796f22b383917b61c06f5379d1bf8afe0
SHA512 00c263e45a6beb894c1878b635e6308b55a41bf1a8b0498bd544cb8f6d6fba20cabca32a2da5af42f24c346ffb4dce91eb7296848a51cb79b38056baeea6c394
SSDEEP 3072:Z67/oGxxIOrXQxPgdT+RuiZb8kVAvreL9e3e7vo/MaiNp3N6afPsout:Z67/oGLgyDzeL9eko/MV6mPsoS
TLSH
T1E7F30297E9B38CB3E022C1FD1E2FC00EB771A2141E5510C5B6AD5D8DCF4A789A16D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2296	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3872	KVEIF.jpg

Loads dropped DLL 4 IoCs

pid	Process
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
2296	svchost.exe
3872	KVEIF.jpg
4528	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kernel64.dll	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File opened for modification	C:\Windows\SysWOW64\kernel64.dll	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 2296	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe	85
PID 3872 set thread context of 4528	3872	KVEIF.jpg	88

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4012-12-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-14-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-34-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-39-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-33-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-32-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-30-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-28-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-26-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-25-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-22-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-21-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-18-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-16-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-10-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-8-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-7-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-3-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/4012-4-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/2296-105-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-115-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-121-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-129-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-127-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-125-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-123-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-119-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-117-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-113-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-111-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-109-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-107-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-104-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-133-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-131-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-140-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-141-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/4012-147-0x0000000000590000-0x00000000005E5000-memory.dmp	upx
behavioral1/memory/2296-142-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-149-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-148-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-135-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/2296-134-0x0000000002450000-0x00000000024A5000-memory.dmp	upx
behavioral1/memory/3872-161-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-164-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-191-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-190-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-188-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-186-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-184-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-182-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-180-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-176-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-174-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-173-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-170-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-168-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-166-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-163-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-192-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-178-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/3872-195-0x00000000004F0000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/4528-200-0x0000000001DE0000-0x0000000001E35000-memory.dmp	upx
behavioral1/memory/4528-205-0x0000000001DE0000-0x0000000001E35000-memory.dmp	upx

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\1D11C18123.IMD	KVEIF.jpg
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFs5.ini	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\ok.txt	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\$$.tmp	svchost.exe
File created	C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\FKC.WYA	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFs5.ini	KVEIF.jpg
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFss1.ini	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIF.jpg	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFmain.ini	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\FKC.WYA	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIF.jpg	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\FKC.WYA	KVEIF.jpg
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIF.jpg	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFmain.ini	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\1D11C18123.IMD	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFs5.ini	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\1D11C18123.IMD	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIF.jpg	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\FKC.WYA	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFs1.ini	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\web\606C646364636479.tmp	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
File opened for modification	C:\Windows\web\606C646364636479.tmp	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KVEIF.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
2296	svchost.exe
3872	KVEIF.jpg
3872	KVEIF.jpg
3872	KVEIF.jpg
3872	KVEIF.jpg
3872	KVEIF.jpg
3872	KVEIF.jpg

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2296	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Token: SeDebugPrivilege	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Token: SeDebugPrivilege	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Token: SeDebugPrivilege	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Token: SeDebugPrivilege	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	3872	KVEIF.jpg
Token: SeDebugPrivilege	3872	KVEIF.jpg
Token: SeDebugPrivilege	3872	KVEIF.jpg
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	4528	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4408	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe	84
PID 4012 wrote to memory of 2296	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe	85
PID 4012 wrote to memory of 2296	4012	560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe	85
PID 1212 wrote to memory of 3872	1212	cmd.exe	87
PID 3872 wrote to memory of 4528	3872	KVEIF.jpg	88
PID 3872 wrote to memory of 4528	3872	KVEIF.jpg	88

C:\Users\Admin\AppData\Local\Temp\560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe
"C:\Users\Admin\AppData\Local\Temp\560b1bd1673d4a98993930dad01d5a57529bc30a08459fb8c48dbc6040ccb29b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230395D474A422F565840 0
  2⤵
  PID:4408
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230395D474A422F565840 0
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2296

C:\Windows\system32\cmd.exe
cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230395D474A422F565840
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg
  "C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230395D474A422F565840
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230395D474A422F565840 0
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D11C18123.IMD

Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\1D11C18123.IMD
Size 168KB
SHA256 ae456b861ded6c265959dc565c34dd97bd0212db8db0e2c367d9d728b6aa2077
MD5 54a0b851a178edd604256616e33d7b2b
SHA1 3caf9781673f0b2a478be9d953afb9d402fe3565
SHA512 532f70e501869f433e5882191ebc07abd99cdb19035ad633e12942b0182e22fb54918b9c7b5bb7d4c6c71bc747d3f99dcd21835546aac0b3a48c31aaa5464546
SSDEEP 3072:Yvv/3u3OPIbolLtzk1mEbzaL7c10zCVEHmMLbl7ANxJp1out2sm1GCGGvD8/Jra:YvtPIb0Lq1KXyV6FLblMpHoS2sm1GCGo
TLSH
T1DBF3021FEBB8ECF4C0006AB69DAE11D4541FC3D871DC5139496D9C3B69CA27CA90267A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KVEIFss1.ini

Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\KVEIFss1.ini
Size 22B
SHA256 268f53db6e108565ccc492b450b51fe3f249bba3a8fe23ee0e9682c46d253991
MD5 78ace5492243c3f59c64b0241cb18f37
SHA1 128afc0286c02e0ca1943ba266df15d9c44a8d26
SHA512 56f74ae324699ec8555ba302770a43b933d2ae67a6542f1be726e2ce795a35f63faf966d707f5161df8e88b0c82e7ceaa296330f6576f2191c4620ed9cff10da
MD5 SHA1 SHA512

Submit Download

ok.txt

Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C18\ok.txt
Size 104B
SHA256 c7cc82c358b6c13110f671a62a5690d26e24ae041eaf7c1cd9bb1208ad571c0c
MD5 b7b6711c4a32edf63209c269ec83570d
SHA1 3575401e699551123a8a037f77da0ed330a668a8
SHA512 70beef6dd0c079984d67cb48ce651bcbebdbbfde07d5446777b1c0dd96dcdd1b1cc909ce963126c862b873bea365b30b9dc1cf8ce29a59b7917fe3189b019de2
TLSH
T1FAB0120B43C6C79716845A522960F0CCC8796C551AD93724C525B60F564111BEE83521
MD5 SHA1 SHA512 TLSH

Submit Download

KVEIF.jpg

Path C:\Program Files\Common Files\Microsoft\1D11C18\KVEIF.jpg
Size 167KB
SHA256 aed1a6349e50e41314e5428763f408fbf8a15ff874401b9577c4d245e5633d03
MD5 50ec9e68f6a6ecb51733d5414b1c537c
SHA1 993fdfeb91a851d1251051b88282004b0d8fe7b4
SHA512 cd114c421f881cb668abe7b0232a259f22411ce70250570ab28e0acdb76ac2bb52e8a18140bdcb8a693a37fc487555cd2f9843f94015cded9ef06e4b2771cddb
SSDEEP 3072:067/oGxxIOrXQxPgdT+RuiZb8kVAvreL9e3e7vo/MaiNp3N6afPsout:067/oGLgyDzeL9eko/MV6mPsoS
TLSH
T144F30297E9B38CB3E022C1FD1E2FC00EB771A2141E5510C5B6AD5D8DCF4A789A16D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D11C18123.IMD

Path C:\Program Files\Common Files\microsoft shared\MSInfo\1D11C18\1D11C18123.IMD
Size 167KB
SHA256 604cf0328b4c5e4344a9dcdd0ab7df8fcfdad929a2ad14cb934890772da9cc61
MD5 da144c0d4d969d37452cfd50691720db
SHA1 bb89c46636e7acdfc5cdf3b51a806cbe85dc82da
SHA512 0654501331cc0d617ec1453fca907483534ae375c48387b91b2bbc4c81856c92bab159ec87e15fc668d5b2b2ae0285105ce65e84ce47929b7c0e09964d6ef722
SSDEEP 3072:I67/oGxxIOrXQxPgdT+RuiZb8kVAvreL9e3e7vo/MaiNp3N6afPsout:I67/oGLgyDzeL9eko/MV6mPsoS
TLSH
T19DF30297E9B38CB3E022C1FD1E2FC00EB771A2141E5510C5B6AD5D8DCF4A789A16D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KVEIFmain.ini

Path C:\Program Files\Common Files\microsoft shared\MSInfo\1D11C18\KVEIFmain.ini
Size 1KB
SHA256 dbabf1c8c9fa282e05e987646e94b73683792bd73fa66e75b35e193fa70c60dd
MD5 ecd01d8edf5445f12182b661b5bae331
SHA1 c32ec8c0dcba8994d0dfc16924186f541adc847e
SHA512 f16fd4a31cee0323297fbe96a8143e7a68f529fd4da1a96be1f2f485682d8a368e927d21d062c2b13ed6d0aa6b8dd149c140a2566e107f44e8a40e8f5d40c0a5
TLSH
T1343134B586B2C1F0C2310890D20B8AA19773F80F6140A8F8919920D8F84489E8F73ABC
MD5 SHA1 SHA512 TLSH

Submit Download

kernel64.dll

Path C:\Windows\SysWOW64\kernel64.dll
Size 625KB
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
SSDEEP 12288:jnBiMQ99uGlsU/9GVkIle38wsquxPLFNmb7uMkHHk4JlQ/Saho6:jBo99hlsUFGVkqeXsquxPLFNGTMk4JlI
TLSH
T15BD4AE02FB44C5B9F9E728B1295C3637997D993007116CC772504BEE9A38AD0AE3B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

606C646364636479.tmp

Path C:\Windows\Web\606C646364636479.tmp
Size 108KB
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
SSDEEP 3072:exxIOrXQxPgdT+RuiZb8kVAvreL9e3e7vo/MaiNp3N6p:eLgyDzeL9eko/MV6p
TLSH
T1D1B312FEDB765CD23A4241EAAF2DC08C7380D2551D9620D8815DED898F0A49FF2EE1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2296-141-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-123-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-245-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-244-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2296-134-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-135-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-148-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-142-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-103-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2296-140-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-131-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-133-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-104-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-107-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-109-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-98-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2296-111-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-101-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2296-105-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-115-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-121-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-129-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-127-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-125-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-149-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-119-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-117-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/2296-113-0x0000000002450000-0x00000000024A5000-memory.dmp

Download

memory/3872-195-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-191-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-242-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-186-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-188-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-178-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-192-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-163-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-166-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-168-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-170-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-173-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-241-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3872-190-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-174-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-176-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-180-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-182-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-159-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3872-161-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-184-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/3872-164-0x00000000004F0000-0x0000000000545000-memory.dmp

Download

memory/4012-16-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-8-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-32-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-26-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-28-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-14-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-22-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-21-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-34-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-18-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-39-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-10-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-147-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-33-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4012-12-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-7-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-3-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-25-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-30-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-4-0x0000000000590000-0x00000000005E5000-memory.dmp

Download

memory/4012-146-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4528-203-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download

memory/4528-201-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download

memory/4528-205-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download

memory/4528-200-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download

memory/4528-199-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4528-233-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download

memory/4528-249-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4528-250-0x0000000001DE0000-0x0000000001E35000-memory.dmp

Download