7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
Size 10.8MB
Sample261018-sdgsmsd19p
SHA256 7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2
MD5 0a788f4161e8ee1ac5557c4345bc3331
SHA1 3a82bdda92eb2b8b4f5ee145714084ae3e273f5a
SHA512 1b1eaa3e7df68f7e04df66ea83e9892dcbc53a842bd22eb17adb008787f2a24e9aa91227ed6d0671a9640353d669335ae4fb8a70854b4122b6bd11b35c74038e
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBj:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQq
TLSH
T1A1B633E6795E2ABBC10D1C798D568D23796C57B1CB544CA7FFD53EB60800C932B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2280	BackgroundTask.exe

Executes dropped EXE 13 IoCs

pid	Process
2280	BackgroundTask.exe
3256	BackgroundTask.exe
2092	SecurityCore.exe
5528	SecurityCore.exe
1328	RuntimeBroker32.exe
5004	RuntimeBroker32.exe
4468	CoreSystem.exe
5896	CoreSystem.exe
3360	SecurityCore.exe
3388	SecurityCore.exe
2924	WindowsInternal.exe
2552	WindowsInternal.exe
4124	CoreSystem.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\Diagnostics\\WindowsInternal.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	WindowsInternal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\BackgroundTask.exe\""	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Low\\Microsoft\\CryptnetUrlCache\\RuntimeBroker32.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	RuntimeBroker32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\CoreSystem.exe\""	CoreSystem.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\SecurityCore.exe\""	SecurityCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Explorer\\SecurityCore.exe\""	BackgroundTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
44	raw.githubusercontent.com
55	raw.githubusercontent.com
64	raw.githubusercontent.com
9	raw.githubusercontent.com
20	raw.githubusercontent.com
71	raw.githubusercontent.com
80	raw.githubusercontent.com
1	raw.githubusercontent.com

Detect suspicious telegram bot 7 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c50b-27.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c50d-48.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c518-110.dat	suspicious_telegram_bot
behavioral2/files/0x000e00000001c519-117.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016a28-151.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016a8f-186.dat	suspicious_telegram_bot
behavioral2/files/0x0005000000016a28-220.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 26 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CoreSystem.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsInternal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsInternal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreSystem.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
2280	BackgroundTask.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
2092	SecurityCore.exe
2092	SecurityCore.exe
2092	SecurityCore.exe
2092	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5528	SecurityCore.exe
5004	RuntimeBroker32.exe
5004	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
1328	RuntimeBroker32.exe
5896	CoreSystem.exe
5896	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
5896	CoreSystem.exe
5896	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
4468	CoreSystem.exe
3388	SecurityCore.exe
3388	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe
3388	SecurityCore.exe
3388	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe
3360	SecurityCore.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3256	4312	7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe	92
PID 2280 wrote to memory of 2092	2280	BackgroundTask.exe	93
PID 5528 wrote to memory of 5004	5528	SecurityCore.exe	99
PID 1328 wrote to memory of 5896	1328	RuntimeBroker32.exe	102
PID 4468 wrote to memory of 3388	4468	CoreSystem.exe	104
PID 3360 wrote to memory of 2552	3360	SecurityCore.exe	108
PID 2924 wrote to memory of 4124	2924	WindowsInternal.exe	109

C:\Users\Admin\AppData\Local\Temp\7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe
"C:\Users\Admin\AppData\Local\Temp\7a8de72c67e3b8727006d3435f6f58409a44a451d0fd91f433f3d693bf1311c2.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:3256

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2092

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
  "C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
"C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2552

C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
"C:\Users\Admin\AppData\Local\Temp\\Diagnostics\WindowsInternal.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 312B
SHA256 f81c4d14e873614514725d56abd8f0be34b6f5d4477cd74ca95c932b5983b14b
MD5 0227e28c5d089b59e4d0861b677bd89d
SHA1 7cb7b790d9d3c5abb7127e2c4e472490554db2f5
SHA512 53f9b98fe942c6cd7ced07851b93000da0f866d115b17752fb3fabc8da3ff5e238e07645bf902f960d7da00b809e0f5b63bbca0dd63c4c3ba2236eba97c42989
TLSH
T17AE0E716F70D58943B76CF5DCDA1196F7C73301950C44509282D54E44C031E64407498
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 4547662d95ffc6ea63e0bd4c6c75463c95d594c7239e111791a1debfbe75513d
MD5 6e3001ed97ef86477e390f9a610b311d
SHA1 fe32dfc96fd3e54ddbccc89b78df22abe8396af2
SHA512 14026ccf65e8c7a9009af766e180543791a6ad31b532280afbe017ea7081ea7fd89d922296486f004eb4a58149f7a0a93c8f270e05b7c873fcc3d0ef9088501b
TLSH
T14A41B8ED2B3C3824FF86CFC14939DB372E79B1D49544645532FA85623045BE52E1549C
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\421EC2E1E0F47FC59DB99BB19E16DA88
Size 279B
SHA256 97e8275b1265f18faa1c822b003da554dc4f197c3ef7e8d7b4e6f954a57592f5
MD5 51247251ca18ff9d40f011c533b0831c
SHA1 df10b4463b52638d64f3a534e7206be9b92754d5
SHA512 123959014a85fbb83f01c1f726852ded60a542a1e45c0544d6dcd522c6daca513b378fd40f99cb6dde38e0d66b02238a8dd3e3d91a4b23731976d0a4914a7eda
TLSH
T120D02B16C2BD24923D63DCA1D981786570B39A7A63A6551A7498801A9806AEA1D09298
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 185KB
SHA256 752a3be6aa420194142f366b3840491646a843e46e3c9f6562f1b946f9723dcb
MD5 22bcfc307899b47371e87a3bb3d2198e
SHA1 8865149fee3a9b9ebd7a509eb93adb37b408fd2e
SHA512 c1d42010d4816d7642c92100d21ff3f4bfa8ab0419b8e6941e1048ede2238cd2d7ad514000efba8eaf6b1aea0656790c9b89d071ef908106095d22229d25b3db
SSDEEP 3072:pO909JXxqzrYgNGuPFj0CxK1YlM10RKfgYdgghuch:pOgc4CGuPFj1xKItaDh
TLSH
T1C0042D186DBBB1619F4ACDA24C9AA95E03F571DF2312331B4EB76E901D43A9BCE0744C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 2c65fe8529a61d5cc1afdb06dfc967b9f37eeb990b48429ca01e53bb025e1730
MD5 6c5363f6a24862199d9e4fc7c51525bb
SHA1 706ca3488bc9e0a1a11065e0b33fa8fe6284a3d5
SHA512 01b431413358b6dee565915138564dea3fc892edb85590f919f4041ca99e422b143ff0847cf3d68ea7f4793200c4ef0b1aa460d741de4dd458d1b976ffae4ef9
TLSH
T1C111258B9EA4B0D15AE256E1C7A8D9327DB434C52DDA34C02CD1C4C720AA7593B0C03F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 dd12d0d67f3440da867b363b6409c70919627eae4ac673febedbf3a6557ed1f3
MD5 7d604b92b237c36bc0102ce90f4b9121
SHA1 1242a8f5743ed31e489fabac08bc01a3e8d4e713
SHA512 790f42e7dde75db266ce511c688f5af8607a4b3849edbbb372ab51b242ae228dad4813c12d74256b4de9ad17e7d2ac8774272d578c9fb8ab8da2abfdbee60ad2
TLSH
T1F041FAE71B5938A07F819F9A19F4C97D2E3898785184888279F3C4D610DABD56C0A44C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f0f6b3f0a47a69caf9f03de5ab13ffa1c19249d8b582f7506a982338fbc5ffa1
MD5 dbcd9680388e6fe6d0216b89de04bdeb
SHA1 415e66fdcaa29a334f032c2cc864536cdd356a6b
SHA512 9fde18e7f00f0792f849a3a02bb2fae8b16d2a66722944f579cb4087ac526dff64b9678c07e6abe24c4af180258889641e2cd9745748ac9332ee57cb02471224
TLSH
T119C08C1C1AAA1A1AF2E8437C12C139439B209101F2818F052AF53A08D9A6B267C38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 91d7a972a7e1a140a7fd96335925442fa2ec21d7367f587654341bd8634f1b47
MD5 59004bfe0a2cea7ec65c67b0c1dd2edf
SHA1 74497e3bdc519c4840127a6e14c72c353d812449
SHA512 4020692a63fb135f26d3f135e03c720039de64c82ce41d5d1af8c9264fb108aa7a269757fd68aba72e24a90368ac103f7932a7bf995efd7c2bdbab198ec8351c
TLSH
T117F05C3C1AFC457DF1B3DE7D67D8B7D25D55F116640405A856E24F08E940F412CD1528
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 4167a9c1451d44ced3a28acf33ef0d4d879f7e892781a593a9da7e2ddd43d113
MD5 d64b9c4151127fdd94ae5cfa14bfb235
SHA1 70d8643f59283f9c4c313e749cc472d2f8522bdc
SHA512 22794d50f9227044631025a5eff0035101eede8a6ccda7c6ba7e6a889b6ce2920694a88b381f018db4ef1c44a5bd16a8812233867b4ba48bfcf0abb43f043923
TLSH
T1E1F0221939FE957BF033EEB853C632744A36E20A300265782BB133093E16F107C22201
MD5 SHA1 SHA512 TLSH

Submit Download

421EC2E1E0F47FC59DB99BB19E16DA88

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\421EC2E1E0F47FC59DB99BB19E16DA88
Size 484B
SHA256 ed89b8f990d9e9c67d47ae3bdb3ccf863a29b6c41cde03ee2f0e78d86abe598b
MD5 f5cee44b4d845f8dccf884fa1cadf730
SHA1 bcd845ae372d1c4acac5dce988743b629cd53bdc
SHA512 486c0e1d4d1c10268b78df0de16fde59483d7016bbaf6c05aacffb70c4d4314564111377aa294f5ea23c3e6a268bb1994367717869ace99390d6c888a38fdecf
TLSH
T167F0AB19097C407FF4B2F87AC2D432BAF626F11674059EFA8AD70B06AA01B002C51B6E
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 cc382fb57788f649d80826fc7b6a9c12533c58e452a5c2a3fa76a824491a05c3
MD5 31b67da2dabfdce422efa105298064fc
SHA1 4a0c2ee8f0623a85f0bf51f01ac0d3daaff017e8
SHA512 0a9ef07d137ce8f82c71e5fae5cf511e81ded87afccae7f47d3da0cab49d7473419474207c04dd72fe395a3c8270c4ce161dac55f040d898d0fda29d8fa025d1
TLSH
T159D0123C1F620135F274E6BE98B30FD149A4791BF282AB5E5BE1515D882EE031C9391E
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 8f2db3d4103dcbe4842b2bff48902eedbf817072fb6adbfcb1e30d78c2bb2d2d
MD5 a4c0d7ae7f356d57cb05c75c7d500f17
SHA1 08fef67a887f4ebc3094042437441a74ee34a19d
SHA512 b950250cb685b43dc822683790f34ce8f47d36b28f4675c13d69a9b45ac36ac54e35cfa8aee24f990e3ada6cb4e3d84bb009afb64387049b826460bf9da16860
TLSH
T179F0A32425F1401DF23227354FF8939BAD19B2573404C8792995030EE507E015D1273C
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 2e03b5f49dc361c9c082eb44c0a1d918eb8b7dd655694476e7676b9b2cab2b57
MD5 7d48f9f96e3c054da0989c29cb368e43
SHA1 a2c4a9ac42d4e465b72b2972cb202fd46c8c4092
SHA512 aa22c0480c7e4635772a1661a24bdcc81518d85c0e58ebc81be4b82f2f8201455874bad00f2804cc24e6d9ccbb8dd3d0573f3fb3746bd1da814d7cd8a5ebf443
TLSH
T1FBF0AB3914EB010FF133E67C43D426C54A33F13321082E6E6AB162891E43E41FD73A15
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 777ad3abf2175375f40f41ebf873d81d9a13ea4995123798692cfabd3afdf5ec
MD5 c2ead0c49b951aae615181b494125b87
SHA1 2c464fec66a45f3d67a8d392dc13f1b2dff46b85
SHA512 458b132033890486313191dbaeeb6fe77c552343c385a9f778f165e913967f1a9f2104b5c9a6bc085e91e7a092f0a4c2412f4a33dc2ee5793265247811d8fbea
TLSH
T17EC08C1D0665061AF2A883BC02D22D839A208510F3819F0126B12A1CCD29F126C34D6E
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker32.exe

Path C:\Users\Admin\AppData\Local\Low\Microsoft\CryptnetUrlCache\RuntimeBroker32.exe
Size 11.1MB
SHA256 1497daa4bbdb08ee072bab729845474d42fe805799aa9cba1698f1166df15e34
MD5 e1c1922e6c31649b9253d5f354a0bd97
SHA1 8dfb3bd8001cd6405b69283a4d8050f1fc06759b
SHA512 a84d37d9a7603a1582708c184919e12174ba2ba70e0a428f45fc649f3fab53df194fae079e974437430d58372725900f7746353085417eab4594ed53d2cf329a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBM:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ7
TLSH
T1E8C633E6794E2ABBC10D1C794D1ACD22796C57B1CB645CA7FFD53DB60800C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsInternal.exe

Path C:\Users\Admin\AppData\Local\Temp\Diagnostics\WindowsInternal.exe
Size 11.4MB
SHA256 237dbda86a63b09b25464f4113650f75de9c8110f4521f18cc1e1cd5b331b218
MD5 7f5ab6b30a7fbc506154ab1ef0c0e57e
SHA1 832c5d9686abffab169b411b2747da3c7c9a6c03
SHA512 fc01e03ba6f500cf0f850e936deef7dea59ed29f97c3adc8bb2894f59c3b1f37cacb0a8c851cff168152d4a0cf6f5901369bcddc4e6e18c9909e054a3adab4b6
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXB9:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ+
TLSH
T1B0C633E6794E2AB7C10D1C798D1ACD22796C57B1CB645CA7FFD53EB60840C932722E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTask.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\BackgroundTask.exe
Size 10.9MB
SHA256 5eb0da63dbb66f8eb9fda4afe884b7feb365f3da3f006d571f968e6e457bd8c2
MD5 0e3f93ea7c5cc3d4533231542fb3f40c
SHA1 e49f2ac6e447ee9b88452d5867137969ebe593c3
SHA512 10a90eef63eb7c1df8eba3c8ec8b6375b61fa632709325722c3b9efba839e250a3bc124653820cd1a5dcf6c43a3203ef10a2bffb8efcb63e990afeb92f9f264b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBW:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQj
TLSH
T158B633E6795E267BC10D1C794D1A8D2279AC57B1CB644CA7FFD53EB60800C932B22E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer\SecurityCore.exe
Size 11.0MB
SHA256 9c1600d088c3494d8341859a40765e4727711541815da53a2f7db962bd0acfeb
MD5 da46fd856bb9c55b7e7099bbd59b63ed
SHA1 9b21d3a393b27488f142ff6b19a004e4db4b9823
SHA512 9cfebeb4c3eda462cdd05b82afaf8e05d565de21f7ffde7639f9a55b2f323c71b0d779358b33307c83472a8c8893c3bc6be358dcf84a097341403c4fc83af11b
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXB7:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQe
TLSH
T189C633E6794E2ABBC10D1C794D1ACD22796C57B1CB645CA7FFD53DB60800C932B22E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 11.5MB
SHA256 7788352d038fe002bc66cd84b29a3ee8b82ef890e72337f1a002cbefad09ee4f
MD5 dc5426efd41893bfd4d45fd26ffc15a5
SHA1 5af9bd08d2534e1fcf8013560f9b77a768274c0e
SHA512 e4ae3398287059b9e241dd19f2c45c509c162b75013517880d4ecc6038589c55121c4745885667fc51fac63845606f0ad0a87be24f8d8d27cd14b62c62a1a08c
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBQ:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ5
TLSH
T1FEC633E67D4E26BBC10E1C794D1ACD22796C57B1CB645CA7FFD53EB60840C922722E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreSystem.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\CoreSystem.exe
Size 11.2MB
SHA256 2a0be499f6b76fb03f76f26bbd92276a87979883383c62b6a784f22292cadde4
MD5 45c774ae2567914f6e216fbf165cc80f
SHA1 97a2508c5e623289cbb8d2fac38dad5105864a1f
SHA512 565a866d992640e5fc2ad92a16a9330a12c80395d17d01845463b83c5e18ca71a8811716ea57f3abcc466a44e712567dc2ea8b49aa125a27cc15a8064b7b4b0f
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXB3:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ4
TLSH
T195C633E6794E2AB7C10D1C758E1ACD23796C57B1CB645CA7FFD53DB60840C922B22E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\SecurityCore.exe
Size 11.3MB
SHA256 394d72fe7367682a7a9f566d8798925f7c9cb0980c420098073ab7711aba1c26
MD5 bec7725d41ba79a37354acf9ba519b3b
SHA1 205146ab65980e8341f3e37546c2ef8d1047e3eb
SHA512 f921571de9bdb61c060167e8a18f6f523d7423f9bb8f96e7d0ce634c32c1a03c6a22d9547d8d44a9408874310824fc558bfcd8a460cb52526299a8cdb058d7d4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQCLrEGmcDHPUs2QybISQ+9VUQB9IhZssgcbQyNVXBV:TDpbgBr/4QAMQMrEGRHsww7Q8ReecbQ8
TLSH
T1EAC633E6794E2AB7C10D1C794E1ACD23796C57B1C7645CA7FFD53EB60800C922B22E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download