0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
Size 6.6MB
Sample260916-wmprdstdmg
SHA256 0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4
MD5 18179b6bb5b55127b34ec84a9925b2f7
SHA1 c540595f45ed2590eb3d40a9509224c9f15dfb1d
SHA512 611c6687c85c5773a42b6a04d2235cbaed4cb11a435c3110d222b529b4f1e39b10f2b6a09edf12ac103a5d7d2415ae84c1a6f434cbfd1d933ffea3078f0e7e61
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG81:TDpbgBr/4QAMQaTCvkA3iz2u
TLSH
T1736623E57C6E6ABBC10E1C7E8D178D2275AD0BB1C7504CD2EFD43EB64950D931A22A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2464	NetworkHelper.exe

Executes dropped EXE 16 IoCs

pid	Process
2464	NetworkHelper.exe
1120	NetworkHelper.exe
4504	DesktopWindowManager.exe
2332	DesktopWindowManager.exe
1372	ServiceHost.exe
1456	ServiceHost.exe
5508	ServiceHost.exe
1488	ServiceHost.exe
4156	CoreSystem.exe
2200	CoreSystem.exe
5812	RuntimeBroker32.exe
3752	RuntimeBroker32.exe
2100	WindowsHost.exe
1212	WindowsHost.exe
2284	WindowsInternal.exe
4296	WindowsInternal.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\RuntimeBroker32.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\WindowsInternal.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\NetworkHelper.exe\""	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\DesktopWindowManager.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\ServiceHost.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\ServiceHost.exe\""	ServiceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\CoreSystem.exe\""	ServiceHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
88	raw.githubusercontent.com
1	raw.githubusercontent.com
36	raw.githubusercontent.com
50	raw.githubusercontent.com
62	raw.githubusercontent.com
74	raw.githubusercontent.com

Detect suspicious telegram bot 8 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c596-4.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c59d-76.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c59e-113.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5a8-163.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c59e-207.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c5a8-241.dat	suspicious_telegram_bot
behavioral2/files/0x001000000001c59e-275.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c5a8-310.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	NetworkHelper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	NetworkHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
2464	NetworkHelper.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
2332	DesktopWindowManager.exe
2332	DesktopWindowManager.exe
2332	DesktopWindowManager.exe
2332	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
4504	DesktopWindowManager.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
1456	ServiceHost.exe
1456	ServiceHost.exe
1456	ServiceHost.exe
1456	ServiceHost.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
1372	ServiceHost.exe
5508	ServiceHost.exe
5508	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
5508	ServiceHost.exe
5508	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
1488	ServiceHost.exe
4156	CoreSystem.exe
4156	CoreSystem.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1120	1832	0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe	90
PID 2464 wrote to memory of 2332	2464	NetworkHelper.exe	93
PID 4504 wrote to memory of 1456	4504	DesktopWindowManager.exe	96
PID 1372 wrote to memory of 5508	1372	ServiceHost.exe	97
PID 1488 wrote to memory of 4156	1488	ServiceHost.exe	100
PID 2200 wrote to memory of 5812	2200	CoreSystem.exe	103
PID 3752 wrote to memory of 1212	3752	RuntimeBroker32.exe	108
PID 2100 wrote to memory of 2284	2100	WindowsHost.exe	109

C:\Users\Admin\AppData\Local\Temp\0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe
"C:\Users\Admin\AppData\Local\Temp\0d1d436dfa8cd3450ee8d6fb7b32558151140887ae6153d0f97405174c23b1c4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1120

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1456

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5508

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Temp\\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5812

C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1212

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2284

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 2f581ef61fd84cfd03b7259c38da8540ad444099f615f3100836b7a7ecf8d7dd
MD5 9e5c85523a2e99742fe6ba5a1ef01378
SHA1 b40170b2a56a74ba6579e1efbc594d7407cc77b3
SHA512 a7dd1e9d1db948395e7795e20b549412565e74c439d1956b0b403fc92cfb16ea6cc9d6384d5015c6ab1d3f2391b962f50d4f6c089f23a50636bec2df93c2b521
TLSH
T1A4E07D075B2C8989B619892107C6047F7831714F9CA2064F341D57C8CE4217F5E0B251
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 281B
SHA256 46c23c3315d8f9eb7169a788845d3b07063569e67821c61b0512a354d861c150
MD5 9d6c68669dfba72b907c7ed8f16c29c6
SHA1 e74fe3f27f39d595aaf7ab354ebdc932bb02fcab
SHA512 baef2d79bea01dc9214af5974451e56c61ee0a300b5fa13cd9540d907868130349bf183e671539f107210f4537a2146e7197d3aa1819d471fc5a24078e7fcb20
TLSH
T181D0C71723F9A8922B2B9D0045F082203012367B23A2A9F0204A952AE800E799A06B08
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 176KB
SHA256 c5db0a7e08c57ff6e483620335661519d0f73a82c477c0253091032670a2a65a
MD5 ce2ef07200f5df45b2dba68226a51423
SHA1 dffc6c1a648381eab319d8b80a265a4124ab94d1
SHA512 4bfa9af0134b8eb30a663b5e4e419bae2f442dac9e984bb2bd5688a9fa86fcf5c49625984b170f15a5eda991b443be867ae4124163110aecc3dff096da0f7aa1
SSDEEP 3072:rOe/Kom743/ECq09ff7IvjgvnFt0xVCb2:KAtm7A/htMvjobOgq
TLSH
T104041A646C7BB6A35D4BCE620C9DFA9616F561D92412772ABE347E005C03ABFCE17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90
Size 584B
SHA256 6d473796c6f906f567e4837a54161097d0bbc0f662ade87705e46237d7c1160c
MD5 dd53e71a76a3ff61d16963c00af0e241
SHA1 4b8da97d8448de02f98f1a09019544e43519554a
SHA512 97eb6cb088bf81a51ef00bfedc8baeafd8219b20fb9522b29ea857f3de2e65a29df887065456eacce77a4f5ebde8ceeedbddfcd16d21760b68c3de53dbb54b5b
TLSH
T1C1F047721A183118EED0FF6851ECE763AC343671A8C37A1165DFD4401811F50154148F
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 979B
SHA256 2be89f86a7c292a38c9e84d47be96caf58192b985969b44578d7fc62715658d0
MD5 af9e39b50201061de6d0bfbea9d95b79
SHA1 1a5acc98b38b351fd6ac67864bb7c99f63868fc4
SHA512 0ec5a0ef1026a4bf25a3a701dc3a26fecf911297ae5773a62c26a7aa6721a8f58c84a1bfd8acb5e45e04c3cd402c48d021bd84b544d1dec6675c4dfac9efcba5
TLSH
T1DD11E183AFE4A0909AF366B1DAF8C6357D7864C66CEA74D12C81C896205A71D6B0903F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 16fbfa81942c164cd520bb40ddce4ae5eb957fdc89fdd209b9b77e779d0a3968
MD5 7f2be20532d2661e30ea02719a3a5086
SHA1 83fe5d5874b91f13261f949a906655e571015d7a
SHA512 9b1ddab9b5869ab636790211e4a49624006a879125244336d0fc4823b0e4e686599d123eeced6b41d41044806ea870afbce168fe86022fbde51119d3b2c7f36a
TLSH
T1A441E7E72F4674A8AE458FC9297DC57B2E38947691841D42B8B7C8C205DEFE1584B90C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 24a963b42215e431ff475709493501ec1ab1b83ba09b9a9776919f5880e3ccf2
MD5 4588e2d16cc38af4469e3a52d656635d
SHA1 ee5f33144e9aadc6ad7ac638df84067f79cd833f
SHA512 ec2cdea965372ef39f5e3c54caa74faa1638379b64c0ccbae46938e70eba3f1a5e24203b5b671752dd0f6f588065af0213a8ff83704dbe12015b38d04323d215
TLSH
T194C08C1C1AA20A06F6A8837C02C139839B208101E2418F061BF22A08C99AB162A38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 15cec5927c43f23287db25245c8b3f3223726866ae86564c5ada7e2fd6fd86fb
MD5 24c81b08d38fc10285e8d9d46d86438b
SHA1 d2db8f1f03a67da0142198e24e039dd004d789c5
SHA512 519e18642c5521567548c45525e96a8d2e1e9fb5a74e4eb233c712c297aaa2350abeadbc1e95949cf1bd7df1401901cde891990d2f00ac9144e2a3e3ea1d2bb7
TLSH
T1DEF05C3806FC816EE033DF794BD5A3E26C15F116380841FD069107489B05F405CA1228
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 315cb990e8bd69366e1ed7a4323be6c4be6d809d78da1a0244c60fb0896f0fc4
MD5 c40f06a53f70247aea26499283567b96
SHA1 2307e210d6aaf2403bf235f4a9d1649efb56b40c
SHA512 cb54e0607c85a3b4f092639ec772fe76797627391a9c8ceed2de46036c2d8b6f8ba3f2eecc1f558d93ee4ae16ccb4bcb73d53e4e17e4ae44c81b7a6fe22f29e6
TLSH
T1CCF0551428BC403AF033D97EC2E525FAE93AF00A68068AFE069A05009608E011DA2A2F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 2c2375569a10ddc43cc080e1419c1411b205fc0963aff156fbb06f9f1dc23e26
MD5 cd1e8be4a90adf9febab27ff2bc4ee2b
SHA1 dde575e1fc6323f85b59e3386d6f2423bcabdb33
SHA512 45ce3f2db0f3fa828c8dd49de7cea7942852211e7f6e42f8d645984d6cc8887c3cd7e4ce9faae917039723b2b5c3059700f5215ee9cb8dfdc635048725ffd20e
TLSH
T1EFD0131E1352C353F235C17D55F58582BAE06516E555571417E5265C481CE417651C0D
MD5 SHA1 SHA512 TLSH

Submit Download

67F6625BC22310D5C99DDE12020DBD90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90
Size 230B
SHA256 18d96fb1017f445efdaec3de6da72246a7ad3977f40dcba21a9e3908ebf48e2b
MD5 84e0011fb1ce01e2024e1c8d2acd0d01
SHA1 761c386d76c52c4ad723dbf5395bd8a079539169
SHA512 a0d209595c3a0d4742eef92695994ce4f4c796d5ca7bd4a2b7ec6d29b96af7856e7878fdf89504847e483279d4de0b023661565c0cd01890e9c9ef51645da404
TLSH
T1E6D022982FA0871BF041C13BC86046111EB47010D101C749072004484CBBF463D31E02
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 2413d9ae5006af2c2eedf5b07d853eb1d007b58fc08bad2d0befc763b1c27a54
MD5 6ce5befac267e04b748e7d83536cf3ce
SHA1 a2fac939e02b33c02d56420215ff22a6fc8acd8e
SHA512 059e8330f888819553ee11bff7a4eaf92412d1c97f750fc9d5082a69408bfcc52249411a192f756b524539cb2accfe2501eeda2c0ab79724c10abfe4c823e210
TLSH
T1ABF05C2016D2443EEA71667842E053DD7C06F3173400D4651B92460AEE07D011E2383C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 a2420e92a5c1bdbb72efe3fd240c4f43ce3da3290c52b9a15cade0680f387cdb
MD5 7824d2338096f39aad6f807bf500d069
SHA1 d96b1b23d4c8a727106061f62eac44c8eccbebd4
SHA512 859c485e516b0b37fccb5d57eacd3552eac5071da129a2e9eae789294f2fcfc2cdfd1820d97dfea6f8adc7ba55d8ebf005a8420ab51e5fa628c9f419d125bad6
TLSH
T17BF02B3424FB125EF332D67842C521D9A667E13A320927EA6AA347092D49A456560E2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2cb40a8d50ff819b980855acb107786284d8e3e5bce274168d0002788b64058c
MD5 2cc586433a1d1adfea6cec407b0531bf
SHA1 45ab8eab69e4d0b9ed47298ba239930a2aa28bdd
SHA512 635077a589c1305859caf1df317198f5ae4f588e82d8ec62d775b26bfa15680afd20377efefc1ed51b2a4f7d1daf0b075c834925ba884f4c6a3070015840b6b7
TLSH
T177C08C2C07620A07F6A883B902C229839A608110F3819F0526B12A0CDD28F222C74C2A
MD5 SHA1 SHA512 TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\NetworkHelper.exe
Size 6.7MB
SHA256 2200aa7245036bc3bc40a5c2c5ed80033fc65e697a4c90eb4497eba9642047bc
MD5 7b6a9dbbf51fdd7c50e973d0c58d4ed4
SHA1 8df222186d0e9eaf44afe9b51f9c411d201ba5cd
SHA512 1422adf94500df008d7c7872fdf308a7e34e63fc70167d294328a80264e54c9a26525552280d08e07369a66e84334f468f39925d0f7026c1d23a8bef0dcd9a18
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PN:TDpbgBr/4QAMQaTCvkA3iz2aN
TLSH
T1436623E9786E6ABBC10E5C7ECD178D2275AC07B1C7544C93EFD43EB64850D931A22A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\ServiceHost.exe
Size 7.0MB
SHA256 58751fad18088dcc21ee6fb82ce3c48999e0688031924cd66d1e164672c80171
MD5 ecaecba1c41bd535fd69a553bfd03b3e
SHA1 3850bdfbd36850c2d5e31b9529b23681035f13e1
SHA512 9e622a5d64a6a1b3ea00596c14ccf3c281ed7c5f00002579bbc4353024e1d151a297a7880ad0e072882d646a4b0599aceb27c293cf7fe0546702fb87594d7891
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWb:TDpbgBr/4QAMQaTCvkA3iz2apWb
TLSH
T11B7623E57CAE6ABBC10E1C7D8D578D2275AC1BB0C7504CD2EFD43EB64850D931A32A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\WindowsInternal.exe
Size 7.5MB
SHA256 36c89107afe771a9c064e4ccabe973dfc23377ff79a3142af997b245fb02eab0
MD5 95972ca84d6f4d6e8537ad1477bf4cc1
SHA1 969efae491b28ebde40f17332031148d4614b946
SHA512 71f3d9d087950b7ea02b4edabd92a60fae227c88f628b842def092423b0ccb94f46ead6df0423a5406b48e2997e0e0fbf46c6b0dee8c811b5c5379cb97d6776a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWi:TDpbgBr/4QAMQaTCvkA3iz2apWi
TLSH
T1998623E67C5E6AABC10E1C7D8D179D2235AC1BB1C7544CD3EFE43EB64810D931A32A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Temp\CoreSystem.exe
Size 7.1MB
SHA256 83e46667348ee5db9cd98f609e872d6ef06670c5b9a1b94408fe33153530aa3f
MD5 dbffa83c71587ce0ef259a2ed91f4e68
SHA1 5ece495b83dca74efed85dfd408fe69fe0f13016
SHA512 79071d5667ee4c2ef54c64591e378ffd2dbf5aab77c32ef3a12c1f57b6563ef4b48427e715eda4ed600b65041c33291205904736c16017b15abdff6b15c37bee
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWU:TDpbgBr/4QAMQaTCvkA3iz2apWU
TLSH
T1287623E57C6E6ABBC10E1C7D8D178D2275AC0BB1C7544CD2EFD43EB64850E931A32A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\DesktopWindowManager.exe
Size 6.8MB
SHA256 5f6fffa05fbc4ec82cee01b1c44cbcabdd085da43d4651864c00a6ae568583a2
MD5 1a883b20a4ee2e36b5c49d15ec161a76
SHA1 af0163e988e558fe33b20ca4982618d9d363c047
SHA512 1319d2de50a78601addfd96401aa8b6d22c545181b3160a6bcc287136cc03cbcdc8789d47c35053611838841d5ae8e1f350a65480021ff0d96aaa6629c0e7906
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWH:TDpbgBr/4QAMQaTCvkA3iz2apWH
TLSH
T1867623E9786E6ABBC10E1C7ECD179D2275AC07B1C7504CD3EFD43EB64950D931A22A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\RuntimeBroker32.exe
Size 7.2MB
SHA256 348c335c52fdd158d17649346d2d3b20b78962f16890812013dfe36130c6e47a
MD5 8db3122a17f660aef01941ebf89e4f3f
SHA1 84a14fb7cf9e71a3f5f120e45fa0f61295c4aedc
SHA512 22967043ff68588190e560011899d2f7f102c8e28c0d7c27b8be0d42d6f36eed10c0a2a36efb143103a8d1bf9b293f5f352d603fc88345edf1ced072d8d88bf2
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWU:TDpbgBr/4QAMQaTCvkA3iz2apWU
TLSH
T14C7623E67C5E6AABC10E5C7D8D178D2235AC0BB1C7544CD3EFD43EB64850E931A32A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 7.4MB
SHA256 00b8ee5f842feceb1efdf1bfbd252b1d55069ceb8cd3e4366e02d89369dd8af5
MD5 8b2cff7df01285df5734ccad252d8d3a
SHA1 3d7861b51bf4aa64ffdeb9bf4b671354a9cecc66
SHA512 fcfcf89daf2ea765c68a6a9e79e4712fb9161ddc392d99616cf861a680388578b58da646bd2fab0839012a9d76daca7e9f10b991009981172b2bfa3755cd983a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWA:TDpbgBr/4QAMQaTCvkA3iz2apWA
TLSH
T1637623EA7C5E6AABC10E1C798D179D2235AC17B0C7544CD3EFE43EB64850D931A32A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\ServiceHost.exe
Size 6.9MB
SHA256 81cf5c3bd97d6adbf7bd43d810841311dd7105e737d2758c692aec6a5ae60d1f
MD5 3e54c32a2b81e06750ebb0864fefed99
SHA1 3d965d79ef1a965339c355a9fbcf1c55b8ea1811
SHA512 5a3c3daf6e190bd562dbda5cef4c717a18c141d14186cbf1b23930c12cda89b34ba7457de7a10198379e8a34975505705c041b137e1a85218df085e8048858ca
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtZsM5hyfCG8PpWR:TDpbgBr/4QAMQaTCvkA3iz2apWR
TLSH
T1CC7623E97C6E6ABBC10E1C7D8D178D2275AC1BB1C7544CD2EFD43EB64850D931A32A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download