c30c69ad7b8cf413c33b33619e05d435799c2526af61cbbaa22c1776e91e4f78

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
Size

408KB
MD5

22a1cd2624f0edf3452af50f006f75e0
SHA1

4d7ff73c751596a36094e333638629a9adfd9172
SHA256

c30c69ad7b8cf413c33b33619e05d435799c2526af61cbbaa22c1776e91e4f78
SHA512

edaaf532681b64193d89c15703a9407094ec184d54a78a5665074bb53068d8d5690c03017fe02243f59d5f592799be57c9aa0c6b2af74c57a8a711bc4b5e84fa
SSDEEP

3072:CEGh0o2l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG4ldOe2MUVg3vTeKcAEciTBqr3jy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{64230EC1-819F-43e8-A116-2423C632278F}	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{64230EC1-819F-43e8-A116-2423C632278F}\stubpath = "C:\\Windows\\{64230EC1-819F-43e8-A116-2423C632278F}.exe"	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}	{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}	{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}	{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}\stubpath = "C:\\Windows\\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe"	{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}	{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}\stubpath = "C:\\Windows\\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe"	{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}\stubpath = "C:\\Windows\\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe"	{64230EC1-819F-43e8-A116-2423C632278F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}	{64230EC1-819F-43e8-A116-2423C632278F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}\stubpath = "C:\\Windows\\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe"	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A2C3DB5-C718-486e-873A-684BED7D4557}	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6637F782-D4BC-423b-8EB4-CB040F183928}	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6637F782-D4BC-423b-8EB4-CB040F183928}\stubpath = "C:\\Windows\\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe"	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}\stubpath = "C:\\Windows\\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe"	{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}\stubpath = "C:\\Windows\\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe"	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}\stubpath = "C:\\Windows\\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe"	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A2C3DB5-C718-486e-873A-684BED7D4557}\stubpath = "C:\\Windows\\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe"	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}\stubpath = "C:\\Windows\\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe"	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}\stubpath = "C:\\Windows\\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe"	{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe
2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
2904	{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
2752	{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
2112	{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
2192	{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
1548	{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
File created	C:\Windows\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
File created	C:\Windows\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
File created	C:\Windows\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe	{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
File created	C:\Windows\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe	{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
File created	C:\Windows\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe	{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
File created	C:\Windows\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe	{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
File created	C:\Windows\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
File created	C:\Windows\{64230EC1-819F-43e8-A116-2423C632278F}.exe	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
File created	C:\Windows\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	{64230EC1-819F-43e8-A116-2423C632278F}.exe
File created	C:\Windows\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
File created	C:\Windows\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
Token: SeIncBasePriorityPrivilege	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
Token: SeIncBasePriorityPrivilege	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe
Token: SeIncBasePriorityPrivilege	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
Token: SeIncBasePriorityPrivilege	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
Token: SeIncBasePriorityPrivilege	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
Token: SeIncBasePriorityPrivilege	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
Token: SeIncBasePriorityPrivilege	2904	{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
Token: SeIncBasePriorityPrivilege	2752	{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
Token: SeIncBasePriorityPrivilege	2112	{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
Token: SeIncBasePriorityPrivilege	2192	{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2240	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	28
PID 2588 wrote to memory of 2240	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	28
PID 2588 wrote to memory of 2240	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	28
PID 2588 wrote to memory of 2240	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	28
PID 2588 wrote to memory of 2620	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	29
PID 2588 wrote to memory of 2620	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	29
PID 2588 wrote to memory of 2620	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	29
PID 2588 wrote to memory of 2620	2588	22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe	29
PID 2240 wrote to memory of 2060	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	32
PID 2240 wrote to memory of 2060	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	32
PID 2240 wrote to memory of 2060	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	32
PID 2240 wrote to memory of 2060	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	32
PID 2240 wrote to memory of 1572	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	33
PID 2240 wrote to memory of 1572	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	33
PID 2240 wrote to memory of 1572	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	33
PID 2240 wrote to memory of 1572	2240	{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe	33
PID 2060 wrote to memory of 2528	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	34
PID 2060 wrote to memory of 2528	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	34
PID 2060 wrote to memory of 2528	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	34
PID 2060 wrote to memory of 2528	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	34
PID 2060 wrote to memory of 1960	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	35
PID 2060 wrote to memory of 1960	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	35
PID 2060 wrote to memory of 1960	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	35
PID 2060 wrote to memory of 1960	2060	{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe	35
PID 2528 wrote to memory of 2848	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	36
PID 2528 wrote to memory of 2848	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	36
PID 2528 wrote to memory of 2848	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	36
PID 2528 wrote to memory of 2848	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	36
PID 2528 wrote to memory of 2988	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	37
PID 2528 wrote to memory of 2988	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	37
PID 2528 wrote to memory of 2988	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	37
PID 2528 wrote to memory of 2988	2528	{64230EC1-819F-43e8-A116-2423C632278F}.exe	37
PID 2848 wrote to memory of 3036	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	38
PID 2848 wrote to memory of 3036	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	38
PID 2848 wrote to memory of 3036	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	38
PID 2848 wrote to memory of 3036	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	38
PID 2848 wrote to memory of 2844	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	39
PID 2848 wrote to memory of 2844	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	39
PID 2848 wrote to memory of 2844	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	39
PID 2848 wrote to memory of 2844	2848	{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe	39
PID 3036 wrote to memory of 3044	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	40
PID 3036 wrote to memory of 3044	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	40
PID 3036 wrote to memory of 3044	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	40
PID 3036 wrote to memory of 3044	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	40
PID 3036 wrote to memory of 2180	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	41
PID 3036 wrote to memory of 2180	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	41
PID 3036 wrote to memory of 2180	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	41
PID 3036 wrote to memory of 2180	3036	{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe	41
PID 3044 wrote to memory of 2772	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	43
PID 3044 wrote to memory of 2772	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	43
PID 3044 wrote to memory of 2772	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	43
PID 3044 wrote to memory of 2772	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	43
PID 3044 wrote to memory of 2064	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	42
PID 3044 wrote to memory of 2064	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	42
PID 3044 wrote to memory of 2064	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	42
PID 3044 wrote to memory of 2064	3044	{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe	42
PID 2772 wrote to memory of 2904	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	44
PID 2772 wrote to memory of 2904	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	44
PID 2772 wrote to memory of 2904	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	44
PID 2772 wrote to memory of 2904	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	44
PID 2772 wrote to memory of 2736	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	45
PID 2772 wrote to memory of 2736	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	45
PID 2772 wrote to memory of 2736	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	45
PID 2772 wrote to memory of 2736	2772	{6637F782-D4BC-423b-8EB4-CB040F183928}.exe	45

C:\Users\Admin\AppData\Local\Temp\22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\22a1cd2624f0edf3452af50f006f75e0_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
  C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
    C:\Windows\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\{64230EC1-819F-43e8-A116-2423C632278F}.exe
      C:\Windows\{64230EC1-819F-43e8-A116-2423C632278F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
        
        C:\Windows\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
        
        C:\Windows\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
        
        C:\Windows\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A2C3~1.EXE > nul
        8⤵
        
        PID:2064
        
        C:\Windows\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
        
        C:\Windows\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
        
        C:\Windows\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0CA3~1.EXE > nul
        10⤵
        
        PID:2812
        
        C:\Windows\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
        
        C:\Windows\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
        
        C:\Windows\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
        
        C:\Windows\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2AE1~1.EXE > nul
        13⤵
        
        PID:2416
        
        C:\Windows\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe
        
        C:\Windows\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe
        13⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{516B2~1.EXE > nul
        12⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B3E7~1.EXE > nul
        11⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6637F~1.EXE > nul
        9⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB226~1.EXE > nul
        7⤵
        
        PID:2180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1958D~1.EXE > nul
        6⤵
        
        PID:2844
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64230~1.EXE > nul
        5⤵
        
        PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D6DF4~1.EXE > nul
      4⤵
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BC54E~1.EXE > nul
    3⤵
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\22A1CD~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe

Filesize
408KB

MD5
9b00c3198d034a4bb504b06d6500ccdc

SHA1
9017721cd51bc1695e9e1a209dd685935c668bd4

SHA256
c69a33eba307d69264d7cd5de0b3d8bfdb1b52c0c6728625dbbdf8cd5e3477c1

SHA512
6e6c07a75a241a666539035f2a8c17fb941b5d60c917812a97e971db3261d020aef96c276d6578224514ab0057437f505e29763f8ee72289c6979760a0922f64

Download Submit
C:\Windows\{1958D45D-52F6-432e-8BB8-9CA0F0CC55DD}.exe

Filesize
408KB

MD5
9b00c3198d034a4bb504b06d6500ccdc

SHA1
9017721cd51bc1695e9e1a209dd685935c668bd4

SHA256
c69a33eba307d69264d7cd5de0b3d8bfdb1b52c0c6728625dbbdf8cd5e3477c1

SHA512
6e6c07a75a241a666539035f2a8c17fb941b5d60c917812a97e971db3261d020aef96c276d6578224514ab0057437f505e29763f8ee72289c6979760a0922f64

Download Submit
C:\Windows\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe

Filesize
408KB

MD5
4fcdb0e7a511c026402f5606b9850b32

SHA1
b80333ac80bab7133b65934e6696dd1684000859

SHA256
7193860ce9cdbae0d76b14d4e749478dcc7e59d1002ae9d97f1a4f58043692bf

SHA512
1d1621fa6c4610c1215ee8fc8135965d1be01e06183710f61089fe165194a0a6a396828fbe43241f4e1e64e337fd7073909830058f244c0f8b6c52bf125781af

Download Submit
C:\Windows\{3B3E7CEA-B16A-427d-A22D-10540CF4081B}.exe

Filesize
408KB

MD5
4fcdb0e7a511c026402f5606b9850b32

SHA1
b80333ac80bab7133b65934e6696dd1684000859

SHA256
7193860ce9cdbae0d76b14d4e749478dcc7e59d1002ae9d97f1a4f58043692bf

SHA512
1d1621fa6c4610c1215ee8fc8135965d1be01e06183710f61089fe165194a0a6a396828fbe43241f4e1e64e337fd7073909830058f244c0f8b6c52bf125781af

Download Submit
C:\Windows\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe

Filesize
408KB

MD5
0cdf558089190d47e6c2a7999982d3c2

SHA1
2628ea18e693fea392d3653a241061d361fde099

SHA256
6986ee4bbd88667d6e7f2c9090616ade111b6cce633811b4bfdbf75fd54aad35

SHA512
0a3c9769ea164cb7b17ed933af51b615c1e432924e73621894e9ec658eefd1cb30fce8df3e222fc4fd954423d7e77e5374b12d10733dfbcb15e0f9470d477f48

Download Submit
C:\Windows\{516B2920-1BC9-4d4c-B9B2-1BCD46E8AD1C}.exe

Filesize
408KB

MD5
0cdf558089190d47e6c2a7999982d3c2

SHA1
2628ea18e693fea392d3653a241061d361fde099

SHA256
6986ee4bbd88667d6e7f2c9090616ade111b6cce633811b4bfdbf75fd54aad35

SHA512
0a3c9769ea164cb7b17ed933af51b615c1e432924e73621894e9ec658eefd1cb30fce8df3e222fc4fd954423d7e77e5374b12d10733dfbcb15e0f9470d477f48

Download Submit
C:\Windows\{64230EC1-819F-43e8-A116-2423C632278F}.exe

Filesize
408KB

MD5
230acee2d0660ea21f190fdb581d90f2

SHA1
c080e3157f1832a8407ca18f42d61d8feb5ea667

SHA256
b6c0552b7970e9ee5afa266fb01968aa13691943a886328879736812fd837282

SHA512
2eb0a936eae5ae6ded50f07a78b14f5ab2b50470bbe3d097925162d3cf9379f8039ec4c586b28f8fdcf241fd21ad5190e6a93fb69ac50fa8d3cc5fec6c515bab

Download Submit
C:\Windows\{64230EC1-819F-43e8-A116-2423C632278F}.exe

Filesize
408KB

MD5
230acee2d0660ea21f190fdb581d90f2

SHA1
c080e3157f1832a8407ca18f42d61d8feb5ea667

SHA256
b6c0552b7970e9ee5afa266fb01968aa13691943a886328879736812fd837282

SHA512
2eb0a936eae5ae6ded50f07a78b14f5ab2b50470bbe3d097925162d3cf9379f8039ec4c586b28f8fdcf241fd21ad5190e6a93fb69ac50fa8d3cc5fec6c515bab

Download Submit
C:\Windows\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe

Filesize
408KB

MD5
e3e031eb4e7be66fa931873d7f03456c

SHA1
2e0748a3b18bc663881abd6bf4ceae101a567ed2

SHA256
51404b8af37ee9476d733a1556f40f973cd57c6feb51e2cae169b9a7f4a7927f

SHA512
ea6c608d9afa0e3fdf679bdebf47510e47f9cc59a6a801f45fcd48eb6fe3d46bdb5fa6eec22d8f5376d48ad34f8aa1412f1866ad90b3cea76efd8dc4b34dfe2b

Download Submit
C:\Windows\{6637F782-D4BC-423b-8EB4-CB040F183928}.exe

Filesize
408KB

MD5
e3e031eb4e7be66fa931873d7f03456c

SHA1
2e0748a3b18bc663881abd6bf4ceae101a567ed2

SHA256
51404b8af37ee9476d733a1556f40f973cd57c6feb51e2cae169b9a7f4a7927f

SHA512
ea6c608d9afa0e3fdf679bdebf47510e47f9cc59a6a801f45fcd48eb6fe3d46bdb5fa6eec22d8f5376d48ad34f8aa1412f1866ad90b3cea76efd8dc4b34dfe2b

Download Submit
C:\Windows\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe

Filesize
408KB

MD5
9bdb552fd93c1898468d57fc8122ed8b

SHA1
159df1ca206abcfd23a516c37f10a9d9423e2cf3

SHA256
16d91ed5241065d75ef2101856109b2eecfe5bafe404da18b4db0453691e26ac

SHA512
3f159ae638d1470404e30862d671bbacfa81f9c34ee2cf0715bd3f89b46d436c87bc70af63a7aa91074a21e4ab77d3970def7121cd86227a3f4901e2dba67f87

Download Submit
C:\Windows\{9A2C3DB5-C718-486e-873A-684BED7D4557}.exe

Filesize
408KB

MD5
9bdb552fd93c1898468d57fc8122ed8b

SHA1
159df1ca206abcfd23a516c37f10a9d9423e2cf3

SHA256
16d91ed5241065d75ef2101856109b2eecfe5bafe404da18b4db0453691e26ac

SHA512
3f159ae638d1470404e30862d671bbacfa81f9c34ee2cf0715bd3f89b46d436c87bc70af63a7aa91074a21e4ab77d3970def7121cd86227a3f4901e2dba67f87

Download Submit
C:\Windows\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe

Filesize
408KB

MD5
2e4d054e657409b21d049839d839c79f

SHA1
1f01a0aaed29fe76b355795cf0bc9935e7935877

SHA256
b2aa472176561c0270686157d30a4ecddac7538cc3bb3b75dd3da42309da24e4

SHA512
764b3603915030d532df07886ede58f73be3c82e7627f59161cf43addbadb0aaf243a5b1af5f20a2fcb02e217de0fa81652f45feef5eaf0a5259904ce5afc92e

Download Submit
C:\Windows\{A0CA34F3-1342-40ec-9DA3-FF4D83876D27}.exe

Filesize
408KB

MD5
2e4d054e657409b21d049839d839c79f

SHA1
1f01a0aaed29fe76b355795cf0bc9935e7935877

SHA256
b2aa472176561c0270686157d30a4ecddac7538cc3bb3b75dd3da42309da24e4

SHA512
764b3603915030d532df07886ede58f73be3c82e7627f59161cf43addbadb0aaf243a5b1af5f20a2fcb02e217de0fa81652f45feef5eaf0a5259904ce5afc92e

Download Submit
C:\Windows\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe

Filesize
408KB

MD5
023f07363a59779edd757f7197958821

SHA1
c4002ea5648e3a47fbcdff2bd096d8df3008228c

SHA256
4c04bc2f71d4916ccf4e07a46bb82c584daadad887ffe54713d9a9b8d0f74e25

SHA512
240b609d1b8732f02f5e511829c2d9027bda743f36446e08808700ed9f2dafe1e73a5a91e3c61f80daffc03dc76d646b08d9569960367e2e79ed97de68b55b4e

Download Submit
C:\Windows\{BB226BBA-90E6-40d4-B8AE-C5385AF836BE}.exe

Filesize
408KB

MD5
023f07363a59779edd757f7197958821

SHA1
c4002ea5648e3a47fbcdff2bd096d8df3008228c

SHA256
4c04bc2f71d4916ccf4e07a46bb82c584daadad887ffe54713d9a9b8d0f74e25

SHA512
240b609d1b8732f02f5e511829c2d9027bda743f36446e08808700ed9f2dafe1e73a5a91e3c61f80daffc03dc76d646b08d9569960367e2e79ed97de68b55b4e

Download Submit
C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe

Filesize
408KB

MD5
6508ba3438dd4847aead06fb71564732

SHA1
76509099c0aa586913e69f5ceef88cfba8b17910

SHA256
7e0a9d44affacc32eaf20e5eb0b2d40118c472619bc05e819bbb8ae2a23af5b7

SHA512
4812ec51fc30871317ec66b9941e7bba8af2f1240df3164fcd0ae10f5d00b995c33d88b8bbaa035a66743795017d6af80134d40e5d7933b5b6ef2a84934de347

Download Submit
C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe

Filesize
408KB

MD5
6508ba3438dd4847aead06fb71564732

SHA1
76509099c0aa586913e69f5ceef88cfba8b17910

SHA256
7e0a9d44affacc32eaf20e5eb0b2d40118c472619bc05e819bbb8ae2a23af5b7

SHA512
4812ec51fc30871317ec66b9941e7bba8af2f1240df3164fcd0ae10f5d00b995c33d88b8bbaa035a66743795017d6af80134d40e5d7933b5b6ef2a84934de347

Download Submit
C:\Windows\{BC54E020-CB54-44f5-8A4E-A3C9311E11E0}.exe

Filesize
408KB

MD5
6508ba3438dd4847aead06fb71564732

SHA1
76509099c0aa586913e69f5ceef88cfba8b17910

SHA256
7e0a9d44affacc32eaf20e5eb0b2d40118c472619bc05e819bbb8ae2a23af5b7

SHA512
4812ec51fc30871317ec66b9941e7bba8af2f1240df3164fcd0ae10f5d00b995c33d88b8bbaa035a66743795017d6af80134d40e5d7933b5b6ef2a84934de347

Download Submit
C:\Windows\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe

Filesize
408KB

MD5
c52693de0689846c4addca4351ae40e6

SHA1
bc326b5769fb1c078956fc26548c3ab9cf41019b

SHA256
fe25e16d75c7bbc98d6e973de14d4ae3c9d820f15124d265d3e21a2b189cb677

SHA512
e2612a819135d4a830650545809e5a8be4634f2b1763c6660117a3a48f5314192a17b5f7e0b7ad3b0e16cdf6eb44508840f671621835c9b3a75b37ac34fe3b5d

Download Submit
C:\Windows\{D6DF4A1F-6DCE-4d9e-B32B-53932CA5C3C7}.exe

Filesize
408KB

MD5
c52693de0689846c4addca4351ae40e6

SHA1
bc326b5769fb1c078956fc26548c3ab9cf41019b

SHA256
fe25e16d75c7bbc98d6e973de14d4ae3c9d820f15124d265d3e21a2b189cb677

SHA512
e2612a819135d4a830650545809e5a8be4634f2b1763c6660117a3a48f5314192a17b5f7e0b7ad3b0e16cdf6eb44508840f671621835c9b3a75b37ac34fe3b5d

Download Submit
C:\Windows\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe

Filesize
408KB

MD5
4c0dc5081e8ee8f587f016a012f3b5ee

SHA1
03c07884896996690ba3962a65926d060a37335c

SHA256
7bb63e7ae8f444117ca1b363d3030e81f0bb5e92a0ed74486bbc0e572c4d5bc9

SHA512
f5b770b715dc5010701d64d66ca99a5776413973790d0d52361d387016f5c038ad64165af7c2387022b60a26db4e9b726b882b5c91991ecf53af80c4f5a842ff

Download Submit
C:\Windows\{E2AE1FCE-6AC0-4249-8AA2-99CDBF1B3475}.exe

Filesize
408KB

MD5
4c0dc5081e8ee8f587f016a012f3b5ee

SHA1
03c07884896996690ba3962a65926d060a37335c

SHA256
7bb63e7ae8f444117ca1b363d3030e81f0bb5e92a0ed74486bbc0e572c4d5bc9

SHA512
f5b770b715dc5010701d64d66ca99a5776413973790d0d52361d387016f5c038ad64165af7c2387022b60a26db4e9b726b882b5c91991ecf53af80c4f5a842ff

Download Submit
C:\Windows\{F44B0FFF-3ABD-44c7-A49E-1D01C00087BF}.exe

Filesize
408KB

MD5
3cce8d8a78a958a153c4facdadcf2185

SHA1
82d7331d1330608af7d3628769c27f324032907d

SHA256
192dab1eae80045741bf1e305e90397cd58153b1b8cf39f3f83512648552592c

SHA512
f4e5369ba3cbbd1dc89379e4bb89b4dfde5d143977a5345a93884751067de32669ed11356d1892b3a2e30198130846cb2c2aed3a12cee20edcb21ada1735387e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads