93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
Size 12.3MB
Sample261003-qbf28az1ex
SHA256 93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26
MD5 1c73cce80b22727d0d15b6adbd1e6522
SHA1 3ca07bf4840a9c711e6edf28f033ac2060451e99
SHA512 8866fcc5af5b2759270bf4103ae4e16d1453cbadbf0bcec7442c4c079735125ec6e2bf0e54ee551068c981ff6865ddc07b66daa591f3b10e7acd11ae99ecd14a
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fT:4JwMrnx5LAeT
TLSH
T1F6D633E7785E266BC21D1C79CD019D233BAC5BB1C7448CE2EFD53DF60950CA22A22E65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1140	CoreSystem.exe

Executes dropped EXE 13 IoCs

pid	Process
1140	CoreSystem.exe
3324	CoreSystem.exe
1080	NetworkHelper.exe
2676	NetworkHelper.exe
4544	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2896	SecurityCore.exe
2892	SecurityCore.exe
5936	NetworkHelper.exe
4072	NetworkHelper.exe
5484	WindowsHost.exe
1372	WindowsHost.exe
1048	DesktopWindowManager.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\NetworkHelper.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsHost.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\CoreSystem.exe\""	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	NetworkHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\SecurityCore.exe\""	DesktopWindowManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Diagnostics\\NetworkHelper.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\DesktopWindowManager.exe\""	DesktopWindowManager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
37	raw.githubusercontent.com
53	raw.githubusercontent.com
58	raw.githubusercontent.com
74	raw.githubusercontent.com
78	raw.githubusercontent.com
6	raw.githubusercontent.com
28	raw.githubusercontent.com
42	raw.githubusercontent.com
61	raw.githubusercontent.com
90	raw.githubusercontent.com
99	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4d2-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4d3-105.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c4d6-140.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4d7-174.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c4d8-209.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4d7-243.dat	suspicious_telegram_bot
behavioral2/files/0x000f00000001c4d8-278.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 28 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DesktopWindowManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetworkHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopWindowManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1140	CoreSystem.exe
1080	NetworkHelper.exe
1080	NetworkHelper.exe
1080	NetworkHelper.exe
1080	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
2676	NetworkHelper.exe
4544	DesktopWindowManager.exe
4544	DesktopWindowManager.exe
4544	DesktopWindowManager.exe
4544	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2240	DesktopWindowManager.exe
2896	SecurityCore.exe
2896	SecurityCore.exe
2896	SecurityCore.exe
2896	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
2892	SecurityCore.exe
5936	NetworkHelper.exe
5936	NetworkHelper.exe
5936	NetworkHelper.exe
5936	NetworkHelper.exe
4072	NetworkHelper.exe
4072	NetworkHelper.exe
4072	NetworkHelper.exe
4072	NetworkHelper.exe
4072	NetworkHelper.exe
4072	NetworkHelper.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3324	4956	93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe	90
PID 1140 wrote to memory of 1080	1140	CoreSystem.exe	92
PID 2676 wrote to memory of 4544	2676	NetworkHelper.exe	96
PID 2240 wrote to memory of 2896	2240	DesktopWindowManager.exe	99
PID 2892 wrote to memory of 5936	2892	SecurityCore.exe	102
PID 4072 wrote to memory of 5484	4072	NetworkHelper.exe	105
PID 1372 wrote to memory of 1048	1372	WindowsHost.exe	108

C:\Users\Admin\AppData\Local\Temp\93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe
"C:\Users\Admin\AppData\Local\Temp\93427c512b5a8645e28e5f996abfea1a1acd5626e9f8d799d3c354d5f8d66c26.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3324

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5936

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5484

C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
"C:\Users\Admin\AppData\Local\Temp\\WindowsHost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 313B
SHA256 acb9d981851f4c3271fad627cdfda2a2d8599028a2b9b0f06fd24acd3767dcad
MD5 eb444c59d03b1567ebbb5e58480a6eef
SHA1 e638b0d4f8bc77cb263d4e561ca3cfd1e286432b
SHA512 43cc6537c3b42c6a520ad798c7d57f02e3a6770d08ee501ac16a6db81365e6c09ba75a15d2b614b2b19ab3d667c9753a671c6e77a54797011705393da73686f8
TLSH
T1D9E0721A362DC0DABF6A49394A6250BF78A1008F00CD855A342C87F84C8262F9F0BA08
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 749860344f94a12e314cdb27fc86b31285596137f12714a6443e366934020d67
MD5 4579cccb20eb53d3f8634118c8b6d128
SHA1 15cb3605bea7c55aa1d417108cccc1313b690090
SHA512 202a34939f16e742a9ed1159f684cb0fd0e2572c158de7fc5600aff8059b8cc8476764f61ad56f55292876199ae82a6863861e141ff788b83c6b10e2c708258c
TLSH
T1DC41A3DE5E2C7464FE818E451938CB322E7CF9C5E480556E70F788B270D6F942D4A88C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 280B
SHA256 b58f7696fc81ea50570304ba19a94ac07ef88f00cb18545c035b4dc13205bfef
MD5 32d66548cf2a8f1b6b0ab9d6c335806c
SHA1 69e42d1c9f5e7760749da4331591e196bba4b81d
SHA512 f8d7ae900b29dbddb66293c320367f3b4dc41ecd372baed0f690bd657d8d92c77f8dd5cb3a10b7d93e1b1d7ed2a90c12d3461dde8845e2c7eeef1ff2c3237842
TLSH
T1A3D02B1D15F56D137E27991487E8E56174651A2713D0485C14498677A8015E9194F704
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 181KB
SHA256 bf28e561c3da89c18fb58785913a85af1caaf1cb0ce2dec299d5f3c9dd4d7ac8
MD5 66d0289acffee96041e8390c8e47a1df
SHA1 090fae2436fb6cad9b18851814995e47cfd8cac8
SHA512 e40ffd0945fab8c38cdd7810716298ae1f0d8c8cdae0bf0e25f7bb1fe710c2a222d6a4bb6d1d1544a03835bf6ec87ba7e080c739338c0538ddcfafbdbb734818
SSDEEP 3072:3tZr/ECXHwcAvW91AQlHQti4XbqM0eCb6SduAd:3tF/DkvE1ASo5rqM0PDR
TLSH
T18A044B542DBBB5A35E4ACE620C99BA9603F561DE2112771BBE306E505D03ABFCF17C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 976B
SHA256 8c7602efe22cb85666dfca8b597ad0f33617fdd861c8bf7e951c305dfe59b3dc
MD5 de10d5794ceacb41f46aacbc68d07747
SHA1 167aa5e4fd0a87215579791b0bcfa181d7848ada
SHA512 6d7a173bbe00ac650b201daa93ebc17e0d4f345d5d321643ec500a76356f2e300ca626f3a414321e9c09eaf98258e5ef52c5f87cbb2b8a6d52d7636bce097323
TLSH
T1131121865FF4A1909AE356A0CAF8E1367CB424C66DEA34822CC688E2245776D7F0443E
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 57c2ac700d8b52ae8edcdda9ac8069ab4dc4ea1233a73844b32803889da2b052
MD5 dc91a314b321d3f0620ef08ba37cec78
SHA1 a4d798cb12adf028013c556a5d39a2c6f9ca1cc5
SHA512 ef5f8e8bb04683a69768312f846bf5c846e2242e64c0695ed4215e7f17b8a9e221f6fe5d8abedfcc8a8c7343deb16d144b5fb993d618b391b2d1afb80acf823e
TLSH
T1974109EB5F097428BE06DF8A1DB9C97A1D3CC1B4D2C40951B4F38486109DB866C0698D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5bd75e277eafdd283f67b2b58d5ec8937c42165e25606649173475140cdc7ec2
MD5 465a19622cf9df0ecabb45703322d117
SHA1 7e77756d606717e4f546c0df46e597bef6c2c62c
SHA512 f0e929d272015de268bf5fde7e9a1b742dd223881ce48bc72bfb04933a504542394eb43698547d88133e239500a60968af9edabdef5458c5cfbf18e82e0dc03a
TLSH
T13DC08C1C1EA22A06F2E8437D42D13D039B208111E3418F191AF22A08C996B162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 420eb3d5640919f4d6dfd2da8be24796bc8bfdd10de2bd660c777d7f288e2ece
MD5 33e6e4b0e11bc34e88eda96389c39fc8
SHA1 81783e71a5c40c00d0b016bf3217e0d709022729
SHA512 abc81646ffc7492be6a12fe76d08fb02e58ce231c53dc18687b00abe46b0d0d30b4e7ed45bbd5dbdab89f273f180730e77a3363f5d41fd661ff8edae54eac05c
TLSH
T1F9F05C3C12F8804DE0B1DA758ED5A2D56C15F123380485AD4EA14608AA06F015CA253D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 e9367aeaaeb21a0ea4c372d592dc25320ab328bd77ba9f605cb9f4e2bde36e1b
MD5 2077b6cfc43281aaf29e23a8f426a37b
SHA1 2e77459aae16cdba15c4c18babba62d6a95d85a9
SHA512 59b5caf73af5bafbc52d5a32ab74f4534f82b64e8d0f02768a442ead415c7fe6c884b1b9a74a2c2980b0a208d8a008ff5b9397d9ac6816fbcea5ccebfbe6bcb1
TLSH
T158F068583EFF923EF0339E3457C670B28D2DE22B2002AAB4257203042B10EA0AC1170D
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 6496220d108828ccf70a69f8ca44155d655e79a942651befad0bfa56178ce071
MD5 19217bf7fff08d3afb8ac2c218534d4c
SHA1 91f67bf9a168aa2f5a0b3e04ea31501aab062252
SHA512 f48832bb8a056d082a3f95526e5ab324c0f624aa0623af7a2791f6d18e015931dbd01cb35f658c649021ce1f42f8a5ad5a6c8bdb28372fbe4dcff941b293f07e
TLSH
T1F8F0AB0028BC402DF8B3E9B4C2D226B6F939F119780487F60BAB02425F53A024E9212F
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 0e14ce1da256660f69e1bd7e57ef3eefa4e533fe1a17545e235dccc1a0954cdd
MD5 9d22ca938e7e57f300f530dc2bc085f3
SHA1 88f071f856953484662d2a927805ec6749f49321
SHA512 5d71a854f2225e2a94291cb21aaa537ebec2a72817b13b9db22b2986f6ca129f596e7b01c29cae633499818c9fab381a534690855f7e2299037c3770c826d3da
TLSH
T1DDD022146FA10336F059823CCDF0062BEB207950B0F3930E1B62232F0D3CE225862C0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 e815ced73ab2506aabf75580027ad4e09b5264e2f24201039c513c30dfd03410
MD5 02007134430ac14d137e96d29305db00
SHA1 5bfa009c94aff734d809dbaecb79c115704981a3
SHA512 2b662660f122744ef31ab7af1fbf159e59c9926b479c1e51d7c8a02ff6509f67fb8465e5b4e86bc8c83aec1c55f9e142f48c95dd65e5cb7376c1dcdf25a24475
TLSH
T1A5F05C342ED2015EF672663D49E85395D904B7153805C45916920A0AEA67FC11D5283C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 3aef0f6d982d24b5a85768f11a0e4ba28ecc15db851810080ba572fa2d1ae9ee
MD5 a72beba3fb185585dc28de0409e7fc1c
SHA1 764aed77ced5fad2003a7183bba8aabd6ad47058
SHA512 a8e1c5ae6fe734228a023c2b7f94f92d6f4cddf2d294c7fd9c2c85f68e09ee276815d479664bdd5e0dffde3976cd21cf1e6a5fcba04eab668ce91c764818a7c2
TLSH
T1FEF0236C24EF015FF533DBBC42C622D55927E37325451A556A7243055D05F41BDF091A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 7f07e1ce2ea2ffaf06ea71e4973f6608de891a24e439ee89b2efa26dbce023f6
MD5 50c562c5bc525bf8c7a34c6051cc87af
SHA1 0e372ec920a6c29caefe157f778dbc5118f18c59
SHA512 bfa0bb7c84334a84a2c9c25abf38182db22d5f15816993b532ce88b64da2a192744621137d870e4da2c9facc4c6af4bc620b0db3847d6602ef20cafb7330a957
TLSH
T168C08C1C4A611606F2A883B802D229838B208210F3819F0526B22A08CD25F162834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\CoreSystem.exe
Size 12.4MB
SHA256 c2d5ccac63540baf3ed3779e99db3929211777c985ef1c90faaaed6a7bd8445b
MD5 b9cc5589ae9bb28c3472f25a7731c600
SHA1 adc3070a6c6d154dc1b3a04c72adff1f925c6a7f
SHA512 363b916c31e4567d03f8a2463bb90057f6f2e49cf8af49cb16f5a4904e49d8dfc468459b51010b72cfe4ef534ba5238941c551773ffa8e752376b0af0630cc6c
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fm:4JwMrnx5LAem
TLSH
T1E4D633E7785E256BC21D1C79CD019D233BAC5BB2C7548CE2EFD53DF60950CA22A22E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsHost.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
Size 12.9MB
SHA256 21bc885596ff883753d44e3e7d32238dc0f333edce7e3fc5a60d3350679558e1
MD5 1c9f61c47870ec6d474e275e8bd8f228
SHA1 22a5dc320714ed9dddc27bbd97aae6c6cc0a4dcd
SHA512 c881295f6e67921db49c0e432cbd66bc1e4e38c2c03fc05adadbbc3bb780ab3d1849883d8b765df2c94df78373c705a7d1e55ccb3654f250f3c5a684a37aad67
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+f5:4JwMrnx5LAe5
TLSH
T15CD633E7785E256BC2191C79CD059D233BAC6BB1C7148CE2EFD93DF60D50C622A22E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\NetworkHelper.exe
Size 12.5MB
SHA256 55b1eb47a4363a193939d6c22942ee3ff29e6d36ff4d938b41b9f4e91a75b8fd
MD5 5829f04bb50430184ba53d4d1e50456c
SHA1 acb70a0b5d7f04b4cc8907065987c6a0376a0249
SHA512 dedc39facef4b8812bcd20a704d354896ee042e542227d2504a712fcc9e8cd25cb97550bb99132a4f3a6a10db4f58dccbd647a0a28e975337b2916cfcef01fb4
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fT:4JwMrnx5LAeT
TLSH
T139D633E6785E257BC2191C79CD019D233BAC5BB2C7548CE2EFD53DF60950CA22A22E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Diagnostics\NetworkHelper.exe
Size 12.8MB
SHA256 70f8799f6f443941e6feec8f2a85d19a860841c203aa6731ca1e02221fa0a80b
MD5 ac0a656968b4bf637b41364ec7b074b5
SHA1 3c0a3ef23ba8be2e5733c6303e85b72aa894291f
SHA512 1938afd895143efaa58ec5b246fb9eef03838f15caa86e3ba8409b838905a0695f463fae26c155fb4681d7cfccb18148f394605748e0e2a9c17063768817e512
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+f3:4JwMrnx5LAe3
TLSH
T1A8D633EB785E257BC2091C79CD019D123BAC6BB1C7149CE2EFD93DF60D50D622A21E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\SecurityCore.exe
Size 12.7MB
SHA256 5d422aaacbaf8817d449b6ec44d7480f2400da19d443d06143aeb317fa41e47c
MD5 2f86d77feb1035e1716b8a26241200e4
SHA1 c7ff331953db151ff1fb8f19a454688688661cdc
SHA512 b0cbc98c9003e536fadad1552e17cf5dfee07b9ae108c4ec68720c4a7a5cee48314c06a5307f5921f2f8b4f892541affea47d3e25cb9b0d8a4a4b5d40b5b2d08
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fo:4JwMrnx5LAeo
TLSH
T1DAD633E6785E257BC20D1C79CD019D223BAC6BB1C7549CE2EFD53DF60D50CA22A22E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 12.6MB
SHA256 5e0e3e218e311cdc5e680e3251cb8aea5960fc2f895564384c6fdc852b533c68
MD5 ed0c7ed1388d4861d89b56f7a5207714
SHA1 fbea430b168e5502d22cf16ad652c12658214169
SHA512 87d6a6ccd25dcb0c9c5142d23a325bd17b623bf99184cde102f3af9ba7c830abe7ec99c6bc98e2310db0d2322e5e618482a328ca55f514dd074c045dd18f8924
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fR:4JwMrnx5LAeR
TLSH
T1AFD633E6785E256BC21D1C79CD019D233BAC5BB1C7548CE2EFD93DF60D50CA22A22E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DesktopWindowManager.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\DesktopWindowManager.exe
Size 13.0MB
SHA256 0570cb42b135447c6e7cdaa181fb1450ebcf64bb981f4c98c3e8f73f760f556d
MD5 42ce41fb070a8ae9a7ab3862ab244a6f
SHA1 498827e7b513243ee5da3e5bafe2acb44493ef38
SHA512 9bb9241f790a94989dd3b9d4d6710a1d6d7ed3f66702e7c79da06263cf4249818c951ec501fb7f88e376376125051bf4c32a71facf833a854006cff795eef504
SSDEEP 393216:TDpbgBr/4QAMQMrEGRHsww7Q8RuWjJwWlTKMq8+fT:4JwMrnx5LAeT
TLSH
T12BD633E7785E256AC21D1C79CD019D123BAC6BB1C7548CE2EFD93DF60D50CA22B21E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download