9ba86c9da9fcdc7c89c10903395f11491e2c2ab651caa0e48319ea34eea61f7e

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

260d55fae0454dace2916e186630c528_goldeneye_JC.exe
Size

372KB
MD5

260d55fae0454dace2916e186630c528
SHA1

387907a30f78295e48bce4b7a2c9215f3afbfdc7
SHA256

9ba86c9da9fcdc7c89c10903395f11491e2c2ab651caa0e48319ea34eea61f7e
SHA512

52c66883d7172bd2541b630dd47f19d2f7d21138e0b9b01704299a9dd50a6af2b9d049725ff2c34c95178b31f4c1a83e65c8c35c1b1ba4b479bb81884af21ef7
SSDEEP

3072:CEGh0oymlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGVl/Oe2MUVg3vTeKcAEciTBqr3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB07C044-390C-4d5e-BD62-8636613C7417}\stubpath = "C:\\Windows\\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe"	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E186F91-D8AD-4694-8A82-DA3E0596C120}\stubpath = "C:\\Windows\\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe"	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{969E592C-4F3A-4af9-B10C-255532BB8E2D}	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3049094B-3747-4684-946F-366DCC5B3141}\stubpath = "C:\\Windows\\{3049094B-3747-4684-946F-366DCC5B3141}.exe"	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{703EB53B-61C9-4594-B65A-9AE2E470922E}	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB07C044-390C-4d5e-BD62-8636613C7417}	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}\stubpath = "C:\\Windows\\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe"	260d55fae0454dace2916e186630c528_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}\stubpath = "C:\\Windows\\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe"	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}	{3049094B-3747-4684-946F-366DCC5B3141}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{703EB53B-61C9-4594-B65A-9AE2E470922E}\stubpath = "C:\\Windows\\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe"	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}\stubpath = "C:\\Windows\\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe"	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}\stubpath = "C:\\Windows\\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe"	{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}	260d55fae0454dace2916e186630c528_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}\stubpath = "C:\\Windows\\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe"	{3049094B-3747-4684-946F-366DCC5B3141}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E186F91-D8AD-4694-8A82-DA3E0596C120}	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{969E592C-4F3A-4af9-B10C-255532BB8E2D}\stubpath = "C:\\Windows\\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe"	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}\stubpath = "C:\\Windows\\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe"	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}\stubpath = "C:\\Windows\\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe"	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3049094B-3747-4684-946F-366DCC5B3141}	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}	{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe

Executes dropped EXE 12 IoCs

pid	Process
2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe
1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
4288	{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe
2300	{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	260d55fae0454dace2916e186630c528_goldeneye_JC.exe
File created	C:\Windows\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
File created	C:\Windows\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
File created	C:\Windows\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
File created	C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
File created	C:\Windows\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	{3049094B-3747-4684-946F-366DCC5B3141}.exe
File created	C:\Windows\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
File created	C:\Windows\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
File created	C:\Windows\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
File created	C:\Windows\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
File created	C:\Windows\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
File created	C:\Windows\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe	{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
Token: SeIncBasePriorityPrivilege	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
Token: SeIncBasePriorityPrivilege	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe
Token: SeIncBasePriorityPrivilege	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
Token: SeIncBasePriorityPrivilege	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
Token: SeIncBasePriorityPrivilege	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
Token: SeIncBasePriorityPrivilege	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
Token: SeIncBasePriorityPrivilege	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
Token: SeIncBasePriorityPrivilege	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
Token: SeIncBasePriorityPrivilege	2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
Token: SeIncBasePriorityPrivilege	4288	{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2444	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	87
PID 3180 wrote to memory of 2444	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	87
PID 3180 wrote to memory of 2444	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	87
PID 3180 wrote to memory of 1328	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	88
PID 3180 wrote to memory of 1328	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	88
PID 3180 wrote to memory of 1328	3180	260d55fae0454dace2916e186630c528_goldeneye_JC.exe	88
PID 2444 wrote to memory of 1288	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	91
PID 2444 wrote to memory of 1288	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	91
PID 2444 wrote to memory of 1288	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	91
PID 2444 wrote to memory of 1848	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	92
PID 2444 wrote to memory of 1848	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	92
PID 2444 wrote to memory of 1848	2444	{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe	92
PID 1288 wrote to memory of 4024	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	95
PID 1288 wrote to memory of 4024	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	95
PID 1288 wrote to memory of 4024	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	95
PID 1288 wrote to memory of 488	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	94
PID 1288 wrote to memory of 488	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	94
PID 1288 wrote to memory of 488	1288	{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe	94
PID 4024 wrote to memory of 1108	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	96
PID 4024 wrote to memory of 1108	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	96
PID 4024 wrote to memory of 1108	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	96
PID 4024 wrote to memory of 1436	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	97
PID 4024 wrote to memory of 1436	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	97
PID 4024 wrote to memory of 1436	4024	{3049094B-3747-4684-946F-366DCC5B3141}.exe	97
PID 1108 wrote to memory of 2616	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	98
PID 1108 wrote to memory of 2616	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	98
PID 1108 wrote to memory of 2616	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	98
PID 1108 wrote to memory of 2836	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	99
PID 1108 wrote to memory of 2836	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	99
PID 1108 wrote to memory of 2836	1108	{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe	99
PID 2616 wrote to memory of 3628	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	100
PID 2616 wrote to memory of 3628	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	100
PID 2616 wrote to memory of 3628	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	100
PID 2616 wrote to memory of 3480	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	101
PID 2616 wrote to memory of 3480	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	101
PID 2616 wrote to memory of 3480	2616	{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe	101
PID 3628 wrote to memory of 2548	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	102
PID 3628 wrote to memory of 2548	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	102
PID 3628 wrote to memory of 2548	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	102
PID 3628 wrote to memory of 3856	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	103
PID 3628 wrote to memory of 3856	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	103
PID 3628 wrote to memory of 3856	3628	{EB07C044-390C-4d5e-BD62-8636613C7417}.exe	103
PID 2548 wrote to memory of 3948	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	104
PID 2548 wrote to memory of 3948	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	104
PID 2548 wrote to memory of 3948	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	104
PID 2548 wrote to memory of 2972	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	105
PID 2548 wrote to memory of 2972	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	105
PID 2548 wrote to memory of 2972	2548	{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe	105
PID 3948 wrote to memory of 2260	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	106
PID 3948 wrote to memory of 2260	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	106
PID 3948 wrote to memory of 2260	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	106
PID 3948 wrote to memory of 3292	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	107
PID 3948 wrote to memory of 3292	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	107
PID 3948 wrote to memory of 3292	3948	{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe	107
PID 2260 wrote to memory of 2964	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	108
PID 2260 wrote to memory of 2964	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	108
PID 2260 wrote to memory of 2964	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	108
PID 2260 wrote to memory of 1640	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	109
PID 2260 wrote to memory of 1640	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	109
PID 2260 wrote to memory of 1640	2260	{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe	109
PID 2964 wrote to memory of 4288	2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe	111
PID 2964 wrote to memory of 4288	2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe	111
PID 2964 wrote to memory of 4288	2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe	111
PID 2964 wrote to memory of 3104	2964	{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe	110

C:\Users\Admin\AppData\Local\Temp\260d55fae0454dace2916e186630c528_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\260d55fae0454dace2916e186630c528_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
  C:\Windows\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
    C:\Windows\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0BAFB~1.EXE > nul
      4⤵
      PID:488
  - - C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe
      C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Windows\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
        
        C:\Windows\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1108
      - C:\Windows\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
        
        C:\Windows\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
        
        C:\Windows\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
        
        C:\Windows\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
        
        C:\Windows\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
        
        C:\Windows\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
        
        C:\Windows\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D59CE~1.EXE > nul
        12⤵
        
        PID:3104
        
        C:\Windows\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe
        
        C:\Windows\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
        
        C:\Windows\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe
        
        C:\Windows\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe
        13⤵
        Executes dropped EXE
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3EFB1~1.EXE > nul
        13⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62232~1.EXE > nul
        11⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{969E5~1.EXE > nul
        10⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E186~1.EXE > nul
        9⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB07C~1.EXE > nul
        8⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{703EB~1.EXE > nul
        7⤵
        
        PID:3480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD23E~1.EXE > nul
        6⤵
        
        PID:2836
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30490~1.EXE > nul
        5⤵
        
        PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{54156~1.EXE > nul
    3⤵
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\260D55~1.EXE > nul
  2⤵
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe

Filesize
372KB

MD5
f5b44d011b16ce089ebfe2cd13d8eb60

SHA1
0dae035eed75f078ae48e2072b28317b481185a9

SHA256
eca8ee18b1d1b4a173a78c5209c49365315bdeddd6d638b16d25fcb02cea1e95

SHA512
cd0513106cebe611f8966bc28d88c21be360841852fc87113c0ea92b204af0706227128d169b4b7a1f43f1bb7bc9a9e4f0719dcf12648d01edf9d3c332cca0dc

Download Submit
C:\Windows\{0BAFB547-8932-47c9-B92F-34BD9B8F8224}.exe

Filesize
372KB

MD5
f5b44d011b16ce089ebfe2cd13d8eb60

SHA1
0dae035eed75f078ae48e2072b28317b481185a9

SHA256
eca8ee18b1d1b4a173a78c5209c49365315bdeddd6d638b16d25fcb02cea1e95

SHA512
cd0513106cebe611f8966bc28d88c21be360841852fc87113c0ea92b204af0706227128d169b4b7a1f43f1bb7bc9a9e4f0719dcf12648d01edf9d3c332cca0dc

Download Submit
C:\Windows\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe

Filesize
372KB

MD5
3ecb08eb62b6ba06b611604e6f42854e

SHA1
b4205526b339254a6e46d39375a2db5f8d11cf86

SHA256
71b4a3ab43cb232312850a87e2cceb57219964944e59199d3e961f08c56b795b

SHA512
05e335009215216d2c3d55b2c6342348da3d4422233bbcf5117eb8ba9578b84e16295dc8907c70ed6490f8ebc9ec6f5074d5bf639a217a9e804c6c420d495e69

Download Submit
C:\Windows\{103074C4-D716-4b1e-8ACB-53BE46B7A81F}.exe

Filesize
372KB

MD5
3ecb08eb62b6ba06b611604e6f42854e

SHA1
b4205526b339254a6e46d39375a2db5f8d11cf86

SHA256
71b4a3ab43cb232312850a87e2cceb57219964944e59199d3e961f08c56b795b

SHA512
05e335009215216d2c3d55b2c6342348da3d4422233bbcf5117eb8ba9578b84e16295dc8907c70ed6490f8ebc9ec6f5074d5bf639a217a9e804c6c420d495e69

Download Submit
C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe

Filesize
372KB

MD5
3d9e43d0d6c39350ce192a0fa84d53cd

SHA1
24e966df3effb11a7c11e99bcea30a5995a35d35

SHA256
567ccf0494a23ba4265c9d6ccf3c70c146d91d01728fd17808b90703416b9498

SHA512
c3410b7ff7426068cedd13fab0ef68be148b63203089aa85b8be516db0907c011e30374940d346f337734910d616240519a0f3c403757282b8d66682af727b9e

Download Submit
C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe

Filesize
372KB

MD5
3d9e43d0d6c39350ce192a0fa84d53cd

SHA1
24e966df3effb11a7c11e99bcea30a5995a35d35

SHA256
567ccf0494a23ba4265c9d6ccf3c70c146d91d01728fd17808b90703416b9498

SHA512
c3410b7ff7426068cedd13fab0ef68be148b63203089aa85b8be516db0907c011e30374940d346f337734910d616240519a0f3c403757282b8d66682af727b9e

Download Submit
C:\Windows\{3049094B-3747-4684-946F-366DCC5B3141}.exe

Filesize
372KB

MD5
3d9e43d0d6c39350ce192a0fa84d53cd

SHA1
24e966df3effb11a7c11e99bcea30a5995a35d35

SHA256
567ccf0494a23ba4265c9d6ccf3c70c146d91d01728fd17808b90703416b9498

SHA512
c3410b7ff7426068cedd13fab0ef68be148b63203089aa85b8be516db0907c011e30374940d346f337734910d616240519a0f3c403757282b8d66682af727b9e

Download Submit
C:\Windows\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe

Filesize
372KB

MD5
f90f3b582dd2185e8b96c3184091774e

SHA1
3dfc322a53443ea6424ead4e58ff1ba0364257fc

SHA256
ccd1cd48b3d6f3b50dd5ab9067864636da75efc52e6b984c2e0a64ddbdf27017

SHA512
8eb5c5d8a66cc905906257ea5e55d10bb34cbdc2f5316de0212dc8d8e892c484a7daa71502f0a1ae459f7ca5b611faabd1830eccf120284356351278aae695ea

Download Submit
C:\Windows\{3E186F91-D8AD-4694-8A82-DA3E0596C120}.exe

Filesize
372KB

MD5
f90f3b582dd2185e8b96c3184091774e

SHA1
3dfc322a53443ea6424ead4e58ff1ba0364257fc

SHA256
ccd1cd48b3d6f3b50dd5ab9067864636da75efc52e6b984c2e0a64ddbdf27017

SHA512
8eb5c5d8a66cc905906257ea5e55d10bb34cbdc2f5316de0212dc8d8e892c484a7daa71502f0a1ae459f7ca5b611faabd1830eccf120284356351278aae695ea

Download Submit
C:\Windows\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe

Filesize
372KB

MD5
287a38ca0a0623dbbe947551a436626d

SHA1
631b8073354637aba7d91c9a1abea0ddacda8e2b

SHA256
3835a920accff581662f0708461e6018d2ed9fa1b1542e184c9dab1bce73a904

SHA512
d87448b05689e165870bf03effe9c6f6890b0fb2c28d12113ef861939507ed4aad37830a4197542de18c5b09c85870d110e4b8e4003af91ca69cabeda4d74712

Download Submit
C:\Windows\{3EFB1015-1044-45e6-856B-A2DE76AE0DCE}.exe

Filesize
372KB

MD5
287a38ca0a0623dbbe947551a436626d

SHA1
631b8073354637aba7d91c9a1abea0ddacda8e2b

SHA256
3835a920accff581662f0708461e6018d2ed9fa1b1542e184c9dab1bce73a904

SHA512
d87448b05689e165870bf03effe9c6f6890b0fb2c28d12113ef861939507ed4aad37830a4197542de18c5b09c85870d110e4b8e4003af91ca69cabeda4d74712

Download Submit
C:\Windows\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe

Filesize
372KB

MD5
12abe3f73834f8868544437d497b49ab

SHA1
d6fbf9cdc8779ec96bb5de4a80fd2777e2653fa5

SHA256
057c534ccd1f43e5ae6ad9896c6767471c3513b5af7cf5f647cb84e2a9356b3e

SHA512
d42f811a613669929940f0a21c5738de6c3c71d9bd614059fb7ad870d12a750960b365bdb6b608ed6a2b9a4420d9cc86e8d36b24d8497419300e7678d40245f0

Download Submit
C:\Windows\{54156136-7AEA-4fcf-BB0C-C68FB921E6E7}.exe

Filesize
372KB

MD5
12abe3f73834f8868544437d497b49ab

SHA1
d6fbf9cdc8779ec96bb5de4a80fd2777e2653fa5

SHA256
057c534ccd1f43e5ae6ad9896c6767471c3513b5af7cf5f647cb84e2a9356b3e

SHA512
d42f811a613669929940f0a21c5738de6c3c71d9bd614059fb7ad870d12a750960b365bdb6b608ed6a2b9a4420d9cc86e8d36b24d8497419300e7678d40245f0

Download Submit
C:\Windows\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe

Filesize
372KB

MD5
4f9395c694d7627211e7f4eaaf04da41

SHA1
b91d86480c2153ae14849750809ab18700e46e5f

SHA256
5f5d65976785d48f158d9e4a17799217f1f74c3046eb1e29cd6d939d441b0868

SHA512
6b0da64a62376d2b720cdf9136ba40cbcbe395a8a41719ac850647dd940b80fbd033b011774d4a9aa6a146219e64d29010b969c11b8b8235f61799bdad6c30d0

Download Submit
C:\Windows\{62232DE3-A503-46c8-9C17-CA61D0BA7BEC}.exe

Filesize
372KB

MD5
4f9395c694d7627211e7f4eaaf04da41

SHA1
b91d86480c2153ae14849750809ab18700e46e5f

SHA256
5f5d65976785d48f158d9e4a17799217f1f74c3046eb1e29cd6d939d441b0868

SHA512
6b0da64a62376d2b720cdf9136ba40cbcbe395a8a41719ac850647dd940b80fbd033b011774d4a9aa6a146219e64d29010b969c11b8b8235f61799bdad6c30d0

Download Submit
C:\Windows\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe

Filesize
372KB

MD5
5257824e452dd8e25d9669935fe22992

SHA1
d3b8986767bf2d213ad94630e95c71a3619fbb06

SHA256
e7b52cd3ba66856d46367f03de71cb0a9b742c0683e1ef90069c56b7025325a6

SHA512
47f47ea83e699dd455a19456e08a301558a1d796b2ff9ca64a73790b5bc6d00c79a293cbf6fed97a356d5158668722a4408fad1d7af5534ac43d69dccb11b858

Download Submit
C:\Windows\{703EB53B-61C9-4594-B65A-9AE2E470922E}.exe

Filesize
372KB

MD5
5257824e452dd8e25d9669935fe22992

SHA1
d3b8986767bf2d213ad94630e95c71a3619fbb06

SHA256
e7b52cd3ba66856d46367f03de71cb0a9b742c0683e1ef90069c56b7025325a6

SHA512
47f47ea83e699dd455a19456e08a301558a1d796b2ff9ca64a73790b5bc6d00c79a293cbf6fed97a356d5158668722a4408fad1d7af5534ac43d69dccb11b858

Download Submit
C:\Windows\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe

Filesize
372KB

MD5
41dd914a35ea290dbe7cb862cb2533a3

SHA1
82b93500abb732a6a92620a1156474a0b27d5723

SHA256
fd5eeb7fc9b3fa0066b75b269c4fb6b04de996695638db15f12828fd215cb01f

SHA512
281b1fe01b9ad2d3809f50a1948ea57cd1e551373c18ec31650193eb98552e682221b37ada921f3849ffa09bc1050ce2aa1dde7f663468010a4d89b03f0bac72

Download Submit
C:\Windows\{969E592C-4F3A-4af9-B10C-255532BB8E2D}.exe

Filesize
372KB

MD5
41dd914a35ea290dbe7cb862cb2533a3

SHA1
82b93500abb732a6a92620a1156474a0b27d5723

SHA256
fd5eeb7fc9b3fa0066b75b269c4fb6b04de996695638db15f12828fd215cb01f

SHA512
281b1fe01b9ad2d3809f50a1948ea57cd1e551373c18ec31650193eb98552e682221b37ada921f3849ffa09bc1050ce2aa1dde7f663468010a4d89b03f0bac72

Download Submit
C:\Windows\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe

Filesize
372KB

MD5
d242db20f035b700a86de5252e044cd6

SHA1
05c57f3ee8be3fe62993e3a32227ab61f9253b1c

SHA256
555039aa546c3a1373025719be729f1a703622c4cb14858c7f2c1266901705e9

SHA512
7284d761c6cc4a90854826e881e41520d7b7f270a3deb484549a740bdfab1a8b25d776f506891df9b61e51c478f978d681658eba96457e9391e966ced9b2f37a

Download Submit
C:\Windows\{CD23EC01-64F9-4bff-A86F-A2B5ED42FC88}.exe

Filesize
372KB

MD5
d242db20f035b700a86de5252e044cd6

SHA1
05c57f3ee8be3fe62993e3a32227ab61f9253b1c

SHA256
555039aa546c3a1373025719be729f1a703622c4cb14858c7f2c1266901705e9

SHA512
7284d761c6cc4a90854826e881e41520d7b7f270a3deb484549a740bdfab1a8b25d776f506891df9b61e51c478f978d681658eba96457e9391e966ced9b2f37a

Download Submit
C:\Windows\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe

Filesize
372KB

MD5
27e9273e7e970cefdb2b0eb68e7298a2

SHA1
44c7ff68b917ff0ad55b195208af562a7f46e6de

SHA256
47da64fea4f68152d0de8016d41dda2170557e8eaac58c60128a30ff6923bb5a

SHA512
17384fe946b7e699cfd5cfb7efc71e0fec4e100d4968e6ee4c7f5a1d4309d644ee99fd169080d720326267a7c4463874e7a739ec9a7f1b3e95142e749b4d7de8

Download Submit
C:\Windows\{D59CE0D2-66A7-4a7e-84FA-6D1059AE5E26}.exe

Filesize
372KB

MD5
27e9273e7e970cefdb2b0eb68e7298a2

SHA1
44c7ff68b917ff0ad55b195208af562a7f46e6de

SHA256
47da64fea4f68152d0de8016d41dda2170557e8eaac58c60128a30ff6923bb5a

SHA512
17384fe946b7e699cfd5cfb7efc71e0fec4e100d4968e6ee4c7f5a1d4309d644ee99fd169080d720326267a7c4463874e7a739ec9a7f1b3e95142e749b4d7de8

Download Submit
C:\Windows\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe

Filesize
372KB

MD5
3ab9ddab335ea4b6500f3f4c42061ee0

SHA1
19d4b41c6f19b2829bc0f3c5bb5a69f1bf2e0365

SHA256
090fdb81edafc34a8fa6fbc0dc70dae5d6e834cd80c199550e5ba3beafb26788

SHA512
7a9c87265beb56f0f49a5b8ffa8270e82bdbfe267ac83a7d288d17f0622d6df34cd69f03d331a4e1688c3cdcbf2caa4702157eca9ad31d4fdf52d8b95db19a30

Download Submit
C:\Windows\{EB07C044-390C-4d5e-BD62-8636613C7417}.exe

Filesize
372KB

MD5
3ab9ddab335ea4b6500f3f4c42061ee0

SHA1
19d4b41c6f19b2829bc0f3c5bb5a69f1bf2e0365

SHA256
090fdb81edafc34a8fa6fbc0dc70dae5d6e834cd80c199550e5ba3beafb26788

SHA512
7a9c87265beb56f0f49a5b8ffa8270e82bdbfe267ac83a7d288d17f0622d6df34cd69f03d331a4e1688c3cdcbf2caa4702157eca9ad31d4fdf52d8b95db19a30

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads