32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
Size 4.7MB
Sample260913-t16wqazdnc
SHA256 32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0
MD5 156af91535c92257c01ff9cfd25fabd2
SHA1 22d94a45240e335760fc45fbcbb615672fdd50f7
SHA512 4114b783493c9b9634e51dcceec2060398cb97886b4e8e02dc28b9fc2acb36b0861c2b23b1e4648de2ad627bba7721e44963bdca3a1d1e2742d8d8a50ba6b537
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLK:+0s420bTaw+i0k1oZBzm8b/GryND4E0K
TLSH
T1383623E1785A6AAFC00A1C7A8D52CE1275AC17B2CB500CA7FFD53EBA4950DD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1704	UpdateService.exe

Executes dropped EXE 16 IoCs

pid	Process
1704	UpdateService.exe
1776	UpdateService.exe
5752	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
2708	InputService.exe
2160	InputService.exe
2520	CoreSystem.exe
3432	CoreSystem.exe
3520	SystemHost.exe
2920	SystemHost.exe
1660	CoreSystem.exe
1688	CoreSystem.exe
2228	SystemHost.exe
4992	SystemHost.exe
4080	ServiceHost.exe
936	ServiceHost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\ServiceHost.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\UpdateService.exe\""	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\RuntimeBroker32.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\InputService.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\CoreSystem.exe\""	InputService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\DesktopWindowManager.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\SystemHost.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\CoreSystem.exe\""	SystemHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\SystemHost.exe\""	CoreSystem.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
44	raw.githubusercontent.com
57	raw.githubusercontent.com
1	raw.githubusercontent.com
11	raw.githubusercontent.com

Detect suspicious telegram bot 10 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c61d-21.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c620-86.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c61d-120.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c622-155.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c61d-189.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c622-218.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c623-238.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c624-273.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c625-305.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c625-306.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InputService.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
1704	UpdateService.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
5752	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
3024	RuntimeBroker32.exe
2708	InputService.exe
2708	InputService.exe
2708	InputService.exe
2708	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2160	InputService.exe
2520	CoreSystem.exe
2520	CoreSystem.exe
2520	CoreSystem.exe
2520	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
3432	CoreSystem.exe
2920	SystemHost.exe
2920	SystemHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1776	3620	32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe	88
PID 1704 wrote to memory of 5752	1704	UpdateService.exe	90
PID 3024 wrote to memory of 2708	3024	RuntimeBroker32.exe	93
PID 2160 wrote to memory of 2520	2160	InputService.exe	96
PID 3432 wrote to memory of 3520	3432	CoreSystem.exe	99
PID 2920 wrote to memory of 1688	2920	SystemHost.exe	104
PID 1660 wrote to memory of 4992	1660	CoreSystem.exe	107
PID 2228 wrote to memory of 4080	2228	SystemHost.exe	108

C:\Users\Admin\AppData\Local\Temp\32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe
"C:\Users\Admin\AppData\Local\Temp\32533f977eb2d6ee65e16707a0c30e05cc8657cc53ff64fb292bf31cec2432d0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1776

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\InputService.exe
  "C:\Users\Admin\AppData\Local\Temp\InputService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2708

C:\Users\Admin\AppData\Local\Temp\InputService.exe
"C:\Users\Admin\AppData\Local\Temp\\InputService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2520

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3520

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1688

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\SystemHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4080

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:936
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe" --monitor
  2⤵
  PID:1304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe"
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 c4f967c6bf8395e191bc1cae9ec7698305ec01848df166bff48881a24c41cb49
MD5 8f26e8cf3c85927d43f9b41bdd5a3898
SHA1 267d2db8943d268ca0f189616c64703306667dc4
SHA512 89957c7b2efa3c45650235a723fc20e860b60a23dfa845edd38263c71d331262f365e83b7aa3f6cdf76c40ebc3cea2ef18b0ffbf7e145389b65b4a5992d545c4
TLSH
T172E0E71A77ECD1D47123DA2047D940353C30356E3886454C740D93D74E41378D7072D8
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 282B
SHA256 36408e52c9acbe4615b115121e4f1915f3764104d7c07f69863305c5a40f9d9d
MD5 888c6e57a832096daf55993a9aa0a1bb
SHA1 c85b5739d1bdb71185093a608ada73a66cf22b43
SHA512 7231500e5f8f8e7664a4409ce6e83ad902b7ecf5cb7c9f690b75a9b0e408d9a03e57927892af75616751e70cc07267c1db2005c2863ab0713ce4b0277683a785
TLSH
T1A6D02B07F5F48C613D32DD101AD6A5347113B53F11D4560DB818819D5E11A3C8A46258
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
Size 584B
SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
MD5 dd53e71a76a3ff61d16963c00af0e241
SHA1 4b8da97d8448de02f98f1a09019544e43519554a
SHA512 97eb6cb088bf81a51ef00bfedc8baeafd8219b20fb9522b29ea857f3de2e65a29df887065456eacce77a4f5ebde8ceeedbddfcd16d21760b68c3de53dbb54b5b
TLSH
T1C1F047721A183118EED0FF6851ECE763AC343671A8C37A1165DFD4401811F50154148F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 2be89f86a7c292a38c9e84d47be96caf58192b985969b44578d7fc62715658d0
MD5 af9e39b50201061de6d0bfbea9d95b79
SHA1 1a5acc98b38b351fd6ac67864bb7c99f63868fc4
SHA512 0ec5a0ef1026a4bf25a3a701dc3a26fecf911297ae5773a62c26a7aa6721a8f58c84a1bfd8acb5e45e04c3cd402c48d021bd84b544d1dec6675c4dfac9efcba5
TLSH
T1DD11E183AFE4A0909AF366B1DAF8C6357D7864C66CEA74D12C81C896205A71D6B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 54a1217cecef8c3d3e0bd63200c1be6431dc56ade04a47a3b5b36fd5c618e398
MD5 094c972993bbc8bc3d6878e2049852cb
SHA1 24a52c099d2340bf40312389bca10426ddf8be10
SHA512 29bcbf73ad166c69ac11e5aabb5b8aa92efd1ffc4ca8c8cdef4498cf14253d59448aa7b0e120051c3ee3038cd4d4809e90b79904ebe941584573bc64359f6a39
TLSH
T15641FAEB1F8938E4FF028F4A59F8C5712D3891B492401E4275B389C215AD7845A4748C
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 1e751159d0a8ec797218074463487c615a120732c2571324c9b99fb1cfe429b4
MD5 6ce0677e6fc8b097d43d5df07fcccc4f
SHA1 bf55d2201accd8dae8310898ce1805cd8b722551
SHA512 c10d316a66a2ddf0b27d1a919a5fb28c74f6f9221240b7b2a57ab20116475fc4ea91bffb1437b5eebcca44831c15b7d79a721b39a50f376783e756a04ed73970
TLSH
T11FF0EC3C16FD846DF572CE79C7C4A7D27D26F213740849D54FA107089A06F01AC91579
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 6025d3c36caa5b918ab05b27e477f1fcb025c37b576d5738a75f2bc55236d859
MD5 b8aa1b0b6407f58fb9d6bdc3c7b53609
SHA1 ff302d613bf1e11c4f4146df408b6c71fe5106bb
SHA512 4cee7c78d26104d31946fb652c4ee8590246c690e544f1cd15eb6d6976ecc48b0afc4bd41587eb0b386412987a6c2cb03fe055c221f8fb6c32ded19cac27e847
TLSH
T1F1F0AB10047C401DF0B7ECF9C2CA65FEAA3BF12A38055AA30A9B16086B02F002C6253F
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
Size 230B
SHA256 174c47c794e9d6e441a0a9ef797fdfee4cc6995f630574a411e01ae6c0a48f28
MD5 daacb0d0b75851b54314510b0f8619d2
SHA1 ff47544a56746d05c66c8eb06183c0aa31782230
SHA512 b06949a89188852693c8bdc1c52aa69ca2d901b84aba4622c829ffd4124f7e9cb3106bc3fcdf894223659a5b0ee9abf3e8defd9a9d3a029edc6914d397231099
TLSH
T1BCD012592F75971BF045D17FC86546121E75F512D141C745076815485CBBF462D71D02
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 2067ee90edfc8a40875afcbcd115399ed7284fe906caa9e9e49b34cd83edc35b
MD5 566a61345b71ef202e57196d862a7ffa
SHA1 95142405b9c64194565fde9de1e55bd6b7400329
SHA512 27ceee55ccdcff74cb2a3a8f916f597a947999805f5f700b3fed4f62fc89696709d69a9cdb72b1f4bcc864620ccea7a11dd800c33b3e43b3a823257d1a9eab0c
TLSH
T155F0EC2416E6447DE671667947E457EDAC0AF3573400D5A51B92450AEE17D011D2283D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 6220962f5af8e77eb7a667bb00b4c7918cf4d815f1c5fc9cfa6737b49477de2d
MD5 2696a578fbcc1f3163dd9e6cfe97e43a
SHA1 fb28975748334e67874910e61d641af3412a32d6
SHA512 ecf60992f3b5001ba461a5da01cb3542ad88ccaae2d8c15bc67b52af81966ce1add71224abdbafc2b4cb461ac27ac4e234c2199f8ca6d5486b2b7a8f8ec3d69d
TLSH
T145F02B3C25BF053FF292D7B943C566DA4523E337311C36696AB1630A7E46E01FA70A22
MD5 SHA1 SHA512 TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\SystemHost.exe
Size 5.3MB
SHA256 67be72b078e06844529bcdaa3b7055a93cd6bc627f944bd5c79d554c1f1c93c1
MD5 d55845423313a6329645f201d8479c1d
SHA1 5a7ff4473ea0c0cc52a4009ec3b22ede2e8ea404
SHA512 c1c6ee7527cc89d7377f5b4d848a54cbe6b95ee87b44ea89d944bdd5f2cd12a2d3bd30b37c48dea2c7282f411c1d10781f68d4375db6bafb8030c3be394c0b1d
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQoM:+0s420bTaw+i0k1oZBzm8b/GryND4E0P
TLSH
T1584623E5785A6AAEC00A1C7A8D52CE1735AC17B2CB500CA7FFD52E7A4D50DD31273932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\UpdateService.exe
Size 4.8MB
SHA256 205ba2011f17e0303e369645be19e06a30733b1270e5345b824be03138be55ae
MD5 ace21e9988327b6ff2539d24a0d246c2
SHA1 b97db6ed8acad37fb41b099a793eb5f7d257c108
SHA512 2c456d0d989c6c9773f9518d8c1204dee3345381628a91eb9d2c43be3d12a2426acc9d5ddc1809402aacf34728061c15923ffdad5c175247d3daa7090087e1f4
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYG1:+0s420bTaw+i0k1oZBzm8b/GryND4E01
TLSH
T1273623E1785A66BEC00A2C7A8D52CE1275AC17B2CB500CA7FFD53E7A4950DD31673A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\CoreSystem.exe
Size 5.2MB
SHA256 cf7dd7f81157c1f5e9fd3d371de1fd06cb348c849d576907086713100a9cb069
MD5 1a9b180744c2bd59775fa255b1bcdff7
SHA1 409d98a4fbe26f616ee3957ea4b78f6ec2222865
SHA512 7d479458eb6d76ae33bc71c71bf4e6e642a66fae9ddbc2a1ba3a6f2e7536bb9d040c4825d356547701c50acdba82966be58ef23c013eb6eccf998ac4e34cd05e
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQoB:+0s420bTaw+i0k1oZBzm8b/GryND4E0A
TLSH
T12B4623E5785A6AAEC00A1C7A8D52CE1375AC17B2CB500CA7FFD52EBA4D50DD31273932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemHost.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\SystemHost.exe
Size 5.5MB
SHA256 c03397e78742ee8aa780528de0dd3f29111d511f98bf9879a25faafac8c8de5b
MD5 aad585d19de0c990752290e85f76641b
SHA1 880550ec0010ed06da6b95bee85374ea53afdf89
SHA512 c5819574beeb0b780d93bdb0690e1317197e0304ff08fb377113ff47642ec7828dd5d2b1000b121975697af899cbdce2c2069e0897bbdfdf9d37ed969e33c850
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQo5:+0s420bTaw+i0k1oZBzm8b/GryND4E0c
TLSH
T1154623E5785A6AAEC00A2C7A8D52CE1775AC17B2CB100CA7FFD52E7A4D50CD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InputService.exe

Path C:\Users\Admin\AppData\Local\Temp\InputService.exe
Size 5.1MB
SHA256 c9fb57e555e6b7c56575736e8a723319683ef7f2f2f95e2cad879ca088831df8
MD5 61db4bb050be144d867b27a89a1b98f6
SHA1 fbf5760b212eccf530ec476a668d2d1be30e3224
SHA512 60571f5331bcc918d45e7ad0e0fc6ef2ad67e16af552371d0bc1cde22f08b5b28952a73a44a0921665eb895652663c52381f2d82b53319f6386683e5541c1925
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkO:+0s420bTaw+i0k1oZBzm8b/GryND4E0d
TLSH
T1A63623E5785A6ABEC00A1C7A8D52CE1235AC17B2CB500CA7FFD52EBA4950DD31673933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\ServiceHost.exe
Size 5.7MB
SHA256 159a5515fe9eac75621a2fceae3dc928fd7ca7b0e2df58d8854535ec93f8cf43
MD5 79de8aed3f9947815e9dbbeb5479fb8d
SHA1 ac6aeb05f949951acb6c02f1ade917231cd53a8c
SHA512 848a034cc7102ba3952ff64e0101cb5c1cb43a05fdd756ef3e7b3db83a141d9e78558dad7259fe65f0b8cd2a7e48237f4ab33e5c3270af67168145548bceb8a9
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQox:+0s420bTaw+i0k1oZBzm8b/GryND4E0k
TLSH
T1DC5623E5785A66AFC01A2C7A8D52CE2275AC17B2CB100CA7FFD52E7A4D50CD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 5.8MB
SHA256 a97f37233ecac2b685be0ef28d9d91e602a63a0a4cad95b14cbc7f7769dcbae5
MD5 05cb7c609862713d232eae863a007a79
SHA1 2f2e3ef2f178aa9d63af54721ab930e3b35c5638
SHA512 d3de33bae48623f0386d6e473fd8c5f40fdc6c033a3df9fb4b2269c78146c0c7244e1bbffbf553dab835fa25dd6e25862372cded6e431e7a9cf94bfd9852b44f
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQoy:+0s420bTaw+i0k1oZBzm8b/GryND4E01
TLSH
T19A5623E5785A66AFC00A2C7A8D52CE1375AC17B2CB100CA7FFD52EBA4950DD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\DesktopWindowManager.exe
Size 5.4MB
SHA256 367779b209b7e6df4c5351a90febb482e988498a26630e73b907a60a78b8e47b
MD5 b2e18d6dd83c5af6b4ed5038341b94dd
SHA1 cae414a68072a50eaab3f6e33363aec8336654e4
SHA512 767d645be57b95179cf10f54158bd3e93632633ed45f5abadc2f3361529dfbd42d3557c6573a38c3eabe28edbe32de303c1010e99566d959afd4efbfe50f34c0
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQoV:+0s420bTaw+i0k1oZBzm8b/GryND4E0O
TLSH
T12A4623E5785A6AAEC00A2C7A8D52CE1375AC17B2CB100CA7FFD52E7A4D50DD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\CoreSystem.exe
Size 5.4MB
SHA256 fbdc8ead151cd4f0b7d47d365bb49a4fe184ef688d34f31a2459b1e77b4fe65c
MD5 2b1e4b6b287d8e0aed5b0ef0d170a85e
SHA1 19f77f05993dedb85e6dacbc55c78b7823760c36
SHA512 371df45e632f042283373b21db80c4e913f9d059d758e5a3ff1d89ff2aa020246bd7b933d6af7597616d120c525dac736e8ab226f4d1c43b5661007d13c7671a
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYGkQod:+0s420bTaw+i0k1oZBzm8b/GryND4E0u
TLSH
T1A34623E5785A6AAEC00A1C7A8D52CE2375AC17B2CB100CA7FFD52E7A4D50DD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\RuntimeBroker32.exe
Size 5.0MB
SHA256 8fd50417b17a38832d6ce38d75c1d20765ff9e1e22cd42fb1f5c22609d13fafa
MD5 847ef9d9f563d4c6968ae56e1f5113fd
SHA1 265fe82ac3a810539fdc267067e93c4115ba4af6
SHA512 b3a6fc0ad30c0020cb7968f3427ff2eac4ed9700533bfc14df5571151afdfd5a129292b12d03530efe7d9a30d0dbebc9f1212b5da921d47d4d72ab4f0bc48775
SSDEEP 98304:+ebGH420Z1Taw8c2fk2S9BoLexvNo+yGoP6cmGH49Pa/VQryN7r74E+jHLYG+:+0s420bTaw+i0k1oZBzm8b/GryND4E0+
TLSH
T1AD3623E1785A6ABEC01A1C7A8D528E2235AC17B2CB500CA7FFD53E7E4950DD31673932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download