3ce389f101a1bee070f81454a48843c237cb69e258cf180100ed7b4da6b9d8b7

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
Size

372KB
MD5

51e558b6caee4ed85f35266108fad8c4
SHA1

354b9f56f4cd40d9faf4b3163be89dc0846b16b2
SHA256

3ce389f101a1bee070f81454a48843c237cb69e258cf180100ed7b4da6b9d8b7
SHA512

518a90ca5ffeb7ccd6a021547d04cef99802a1f8bdec5cdccd8089f0e091cade7dff26c4e7ec810c51cb5aea7aeefea87598ad879614fbaae3c91773292091ac
SSDEEP

3072:CEGh0onmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGIl/Oe2MUVg3vTeKcAEciTBqr3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC16C83-0696-4280-A54B-B262475A0C04}\stubpath = "C:\\Windows\\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe"	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0BF65F6-E711-4c12-8940-B45B477B2023}\stubpath = "C:\\Windows\\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe"	{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}\stubpath = "C:\\Windows\\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe"	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B27FDAC7-914C-4377-A7F3-60698952C511}\stubpath = "C:\\Windows\\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe"	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC16C83-0696-4280-A54B-B262475A0C04}	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97A6D938-AF00-4353-B0DA-8BEAF3006640}	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}\stubpath = "C:\\Windows\\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe"	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}	{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B27FDAC7-914C-4377-A7F3-60698952C511}	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}\stubpath = "C:\\Windows\\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe"	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}	{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}\stubpath = "C:\\Windows\\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe"	{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}\stubpath = "C:\\Windows\\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe"	{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9507126-C105-4203-A2DB-2731CC72AC5A}\stubpath = "C:\\Windows\\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe"	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBF467E6-F0D8-470c-9C58-C913CC836B47}\stubpath = "C:\\Windows\\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe"	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97A6D938-AF00-4353-B0DA-8BEAF3006640}\stubpath = "C:\\Windows\\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe"	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0BF65F6-E711-4c12-8940-B45B477B2023}	{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9507126-C105-4203-A2DB-2731CC72AC5A}	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBF467E6-F0D8-470c-9C58-C913CC836B47}	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe

Deletes itself 1 IoCs

pid	Process
1584	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
2752	{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
1780	{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
2760	{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
2212	{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
File created	C:\Windows\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
File created	C:\Windows\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
File created	C:\Windows\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe	{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
File created	C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
File created	C:\Windows\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
File created	C:\Windows\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
File created	C:\Windows\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
File created	C:\Windows\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
File created	C:\Windows\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe	{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
File created	C:\Windows\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe	{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
Token: SeIncBasePriorityPrivilege	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
Token: SeIncBasePriorityPrivilege	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
Token: SeIncBasePriorityPrivilege	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
Token: SeIncBasePriorityPrivilege	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
Token: SeIncBasePriorityPrivilege	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
Token: SeIncBasePriorityPrivilege	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
Token: SeIncBasePriorityPrivilege	2752	{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
Token: SeIncBasePriorityPrivilege	1780	{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
Token: SeIncBasePriorityPrivilege	2760	{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 828	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	28
PID 2340 wrote to memory of 828	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	28
PID 2340 wrote to memory of 828	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	28
PID 2340 wrote to memory of 828	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	28
PID 2340 wrote to memory of 1584	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	29
PID 2340 wrote to memory of 1584	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	29
PID 2340 wrote to memory of 1584	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	29
PID 2340 wrote to memory of 1584	2340	51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe	29
PID 828 wrote to memory of 2248	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	32
PID 828 wrote to memory of 2248	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	32
PID 828 wrote to memory of 2248	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	32
PID 828 wrote to memory of 2248	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	32
PID 828 wrote to memory of 2604	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	33
PID 828 wrote to memory of 2604	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	33
PID 828 wrote to memory of 2604	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	33
PID 828 wrote to memory of 2604	828	{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe	33
PID 2248 wrote to memory of 2548	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	35
PID 2248 wrote to memory of 2548	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	35
PID 2248 wrote to memory of 2548	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	35
PID 2248 wrote to memory of 2548	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	35
PID 2248 wrote to memory of 2560	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	34
PID 2248 wrote to memory of 2560	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	34
PID 2248 wrote to memory of 2560	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	34
PID 2248 wrote to memory of 2560	2248	{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe	34
PID 2548 wrote to memory of 2808	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	36
PID 2548 wrote to memory of 2808	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	36
PID 2548 wrote to memory of 2808	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	36
PID 2548 wrote to memory of 2808	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	36
PID 2548 wrote to memory of 2828	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	37
PID 2548 wrote to memory of 2828	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	37
PID 2548 wrote to memory of 2828	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	37
PID 2548 wrote to memory of 2828	2548	{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe	37
PID 2808 wrote to memory of 2868	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	39
PID 2808 wrote to memory of 2868	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	39
PID 2808 wrote to memory of 2868	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	39
PID 2808 wrote to memory of 2868	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	39
PID 2808 wrote to memory of 2364	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	38
PID 2808 wrote to memory of 2364	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	38
PID 2808 wrote to memory of 2364	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	38
PID 2808 wrote to memory of 2364	2808	{B27FDAC7-914C-4377-A7F3-60698952C511}.exe	38
PID 2868 wrote to memory of 2876	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	41
PID 2868 wrote to memory of 2876	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	41
PID 2868 wrote to memory of 2876	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	41
PID 2868 wrote to memory of 2876	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	41
PID 2868 wrote to memory of 2852	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	40
PID 2868 wrote to memory of 2852	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	40
PID 2868 wrote to memory of 2852	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	40
PID 2868 wrote to memory of 2852	2868	{CBC16C83-0696-4280-A54B-B262475A0C04}.exe	40
PID 2876 wrote to memory of 2968	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	42
PID 2876 wrote to memory of 2968	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	42
PID 2876 wrote to memory of 2968	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	42
PID 2876 wrote to memory of 2968	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	42
PID 2876 wrote to memory of 1924	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	43
PID 2876 wrote to memory of 1924	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	43
PID 2876 wrote to memory of 1924	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	43
PID 2876 wrote to memory of 1924	2876	{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe	43
PID 2968 wrote to memory of 2752	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	44
PID 2968 wrote to memory of 2752	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	44
PID 2968 wrote to memory of 2752	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	44
PID 2968 wrote to memory of 2752	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	44
PID 2968 wrote to memory of 2740	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	45
PID 2968 wrote to memory of 2740	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	45
PID 2968 wrote to memory of 2740	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	45
PID 2968 wrote to memory of 2740	2968	{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe	45

C:\Users\Admin\AppData\Local\Temp\51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\51e558b6caee4ed85f35266108fad8c4_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
  C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
    C:\Windows\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C9507~1.EXE > nul
      4⤵
      PID:2560
  - - C:\Windows\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
      C:\Windows\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
        
        C:\Windows\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B27FD~1.EXE > nul
        6⤵
        
        PID:2364
      - C:\Windows\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
        
        C:\Windows\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBC16~1.EXE > nul
        7⤵
        
        PID:2852
        
        C:\Windows\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
        
        C:\Windows\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
        
        C:\Windows\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
        
        C:\Windows\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A4FF~1.EXE > nul
        10⤵
        
        PID:2720
        
        C:\Windows\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
        
        C:\Windows\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7C49~1.EXE > nul
        11⤵
        
        PID:2616
        
        C:\Windows\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
        
        C:\Windows\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D0BF6~1.EXE > nul
        12⤵
        
        PID:1452
        
        C:\Windows\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe
        
        C:\Windows\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe
        12⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97A6D~1.EXE > nul
        9⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3794B~1.EXE > nul
        8⤵
        
        PID:1924
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBF46~1.EXE > nul
        5⤵
        
        PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0FC43~1.EXE > nul
    3⤵
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\51E558~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe

Filesize
372KB

MD5
319cbc59f873e84297e5e7f6ea4c5461

SHA1
6555c36ec88d4f33efe7e13ea9af9e9b6c5f88dc

SHA256
bc3a9efc987594e161cba1bc17073d00a514d8a7ae5b52d2b8a17e4c543e7461

SHA512
8daff9d7ae5ed9c909e9089529a58d95e8a3ac11342101a107eb4bab0fa892b5e5317f845690f2a0752157350dc73a4cbdee78987d91096a78825bf058ad4a61

Download Submit
C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe

Filesize
372KB

MD5
319cbc59f873e84297e5e7f6ea4c5461

SHA1
6555c36ec88d4f33efe7e13ea9af9e9b6c5f88dc

SHA256
bc3a9efc987594e161cba1bc17073d00a514d8a7ae5b52d2b8a17e4c543e7461

SHA512
8daff9d7ae5ed9c909e9089529a58d95e8a3ac11342101a107eb4bab0fa892b5e5317f845690f2a0752157350dc73a4cbdee78987d91096a78825bf058ad4a61

Download Submit
C:\Windows\{0FC4306E-D0F5-4c1b-B89D-E7D1D304F790}.exe

Filesize
372KB

MD5
319cbc59f873e84297e5e7f6ea4c5461

SHA1
6555c36ec88d4f33efe7e13ea9af9e9b6c5f88dc

SHA256
bc3a9efc987594e161cba1bc17073d00a514d8a7ae5b52d2b8a17e4c543e7461

SHA512
8daff9d7ae5ed9c909e9089529a58d95e8a3ac11342101a107eb4bab0fa892b5e5317f845690f2a0752157350dc73a4cbdee78987d91096a78825bf058ad4a61

Download Submit
C:\Windows\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe

Filesize
372KB

MD5
94b0faea7e381c43ad54e5a209992873

SHA1
1fab1153801bf66630a81e0024bd5b7a8822da3d

SHA256
639b46ff06a7aabeba618d8b86a49bdedcf09b68006e3cdd632245dc33bb9d38

SHA512
8c1fbba3589dc12d87828d1daa318f5dcf3dab88eac07b6517b94938e7af93e9b51d7dd0dfa182f16fedfc3412706f88fcdf9fd9e052bd230240b402b4e28f7a

Download Submit
C:\Windows\{2A4FFA7B-6989-481f-91EC-361C9E8958F7}.exe

Filesize
372KB

MD5
94b0faea7e381c43ad54e5a209992873

SHA1
1fab1153801bf66630a81e0024bd5b7a8822da3d

SHA256
639b46ff06a7aabeba618d8b86a49bdedcf09b68006e3cdd632245dc33bb9d38

SHA512
8c1fbba3589dc12d87828d1daa318f5dcf3dab88eac07b6517b94938e7af93e9b51d7dd0dfa182f16fedfc3412706f88fcdf9fd9e052bd230240b402b4e28f7a

Download Submit
C:\Windows\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe

Filesize
372KB

MD5
82cde346f6b68bcd236e02d6bb99cce4

SHA1
c4950b4d7519a6b3c42a813a87c709d559c9c219

SHA256
f0871b1cdb924eecb74833e108668be161d4fa10d492fd58b22477337dddaf5c

SHA512
a6ad42c7cad55140a1424f832af10c4b46437a3c807aa388c534685ee4a9e4bb203841ccce8263e0e5a846ab9ac946e5a3888c52ee74640a1d7398677131684c

Download Submit
C:\Windows\{3794B07E-4EE7-4df0-B2C0-0F8F150196A7}.exe

Filesize
372KB

MD5
82cde346f6b68bcd236e02d6bb99cce4

SHA1
c4950b4d7519a6b3c42a813a87c709d559c9c219

SHA256
f0871b1cdb924eecb74833e108668be161d4fa10d492fd58b22477337dddaf5c

SHA512
a6ad42c7cad55140a1424f832af10c4b46437a3c807aa388c534685ee4a9e4bb203841ccce8263e0e5a846ab9ac946e5a3888c52ee74640a1d7398677131684c

Download Submit
C:\Windows\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe

Filesize
372KB

MD5
89d7b8e274ae3fe2e2721dd410e3fdf3

SHA1
c10e06c584869c80aee3d8a605ca2717f3231a7b

SHA256
83b17c0ac00d5a60b408a52c382a3d273aeaae9e0528f774d3ca4b9a15b7b7bf

SHA512
fb8549e41788c8d3130e6525d701d9b49591c5ad9dbf343420f8a28c101897cabe38576d10699291598008bf625c155d975674d363714b7050a33de4eba664a6

Download Submit
C:\Windows\{97A6D938-AF00-4353-B0DA-8BEAF3006640}.exe

Filesize
372KB

MD5
89d7b8e274ae3fe2e2721dd410e3fdf3

SHA1
c10e06c584869c80aee3d8a605ca2717f3231a7b

SHA256
83b17c0ac00d5a60b408a52c382a3d273aeaae9e0528f774d3ca4b9a15b7b7bf

SHA512
fb8549e41788c8d3130e6525d701d9b49591c5ad9dbf343420f8a28c101897cabe38576d10699291598008bf625c155d975674d363714b7050a33de4eba664a6

Download Submit
C:\Windows\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe

Filesize
372KB

MD5
8c2826df42c6976e8434d46e00554ae1

SHA1
2eaf52a2d3debdb7bc394232649edd5df80a94cd

SHA256
a5fb57768d3cef1f85b5ddf72dcf7ab4111afa2ba85f43f6cea4e7a649c992fa

SHA512
cf029578b9ee442c8a1bf63e4e1b9425000d967fae2824177aef2e183e23ba257164719481b354a1894fe4a7008c55ce889845e257e9e0404907df2cb224d87f

Download Submit
C:\Windows\{B27FDAC7-914C-4377-A7F3-60698952C511}.exe

Filesize
372KB

MD5
8c2826df42c6976e8434d46e00554ae1

SHA1
2eaf52a2d3debdb7bc394232649edd5df80a94cd

SHA256
a5fb57768d3cef1f85b5ddf72dcf7ab4111afa2ba85f43f6cea4e7a649c992fa

SHA512
cf029578b9ee442c8a1bf63e4e1b9425000d967fae2824177aef2e183e23ba257164719481b354a1894fe4a7008c55ce889845e257e9e0404907df2cb224d87f

Download Submit
C:\Windows\{C503BA2F-54D4-4e11-86E9-672D0C0577A7}.exe

Filesize
372KB

MD5
17e172360faf549c9e7785b9856ec6be

SHA1
194f4a0a4391d44ffda2fe103d4f46e2805a9bb4

SHA256
a599a88b69765cb5b0643191f595d57b8260771793d9da6cb86dd0b4c3daf4b2

SHA512
469cae918fcc07b9ff13cdcd95ed66098f4424561872a722c65299394d1eb0614a79e30187088630cda832ba5b2a0003a393029617b99dddce3e2f28a5cfbe7c

Download Submit
C:\Windows\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe

Filesize
372KB

MD5
69d86062059ba9374d909aa4684af2ba

SHA1
c6b85046633cb19000b39cdb61031a5ce80252ba

SHA256
7e3f0a5bac5503cd90becb0b7e9cf57a6b9bc1c8a1243c805653441d49bfa7d5

SHA512
ca87840637159f3f65c41ffceab83edc8426679ae9aff99f4ca66d700328af998354038523e628035fc2b950d6e35a99421f3a6126f84119a44d4c2b0b0a60f2

Download Submit
C:\Windows\{C9507126-C105-4203-A2DB-2731CC72AC5A}.exe

Filesize
372KB

MD5
69d86062059ba9374d909aa4684af2ba

SHA1
c6b85046633cb19000b39cdb61031a5ce80252ba

SHA256
7e3f0a5bac5503cd90becb0b7e9cf57a6b9bc1c8a1243c805653441d49bfa7d5

SHA512
ca87840637159f3f65c41ffceab83edc8426679ae9aff99f4ca66d700328af998354038523e628035fc2b950d6e35a99421f3a6126f84119a44d4c2b0b0a60f2

Download Submit
C:\Windows\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe

Filesize
372KB

MD5
6fd0668a9b24eb70ea1c72601c1ef9f2

SHA1
290ca41c3af8e9cfa3f9e5717fdb0dcb393d5367

SHA256
8e9357c815000782164d7b8586996dc57092d26d1843106b58b3c5736e7e051f

SHA512
9accf780fd9d97df107490c779139c1eb052b1bee2848230531ac1f98ee2e76497237d8a9c13a82fcac8c1dfdc018f3db6ead1338dfad663bc38709875af2f31

Download Submit
C:\Windows\{CBC16C83-0696-4280-A54B-B262475A0C04}.exe

Filesize
372KB

MD5
6fd0668a9b24eb70ea1c72601c1ef9f2

SHA1
290ca41c3af8e9cfa3f9e5717fdb0dcb393d5367

SHA256
8e9357c815000782164d7b8586996dc57092d26d1843106b58b3c5736e7e051f

SHA512
9accf780fd9d97df107490c779139c1eb052b1bee2848230531ac1f98ee2e76497237d8a9c13a82fcac8c1dfdc018f3db6ead1338dfad663bc38709875af2f31

Download Submit
C:\Windows\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe

Filesize
372KB

MD5
4b21ff2ad07f233653c34e18d1a730f6

SHA1
7c63f46ec449d455ea8c8f58c5c3a8f369d68bdd

SHA256
073cd01bba497744964d120aca728fd5adac909c6dd1caf7928703ce59a84e65

SHA512
bc36fba4765771776c851811d9b6298725aa7b84646fea0b9845dd789839624e3a2b5ce5d55380b9ab39ee782530235fda55da65043217542c6e7514f8be9c79

Download Submit
C:\Windows\{D0BF65F6-E711-4c12-8940-B45B477B2023}.exe

Filesize
372KB

MD5
4b21ff2ad07f233653c34e18d1a730f6

SHA1
7c63f46ec449d455ea8c8f58c5c3a8f369d68bdd

SHA256
073cd01bba497744964d120aca728fd5adac909c6dd1caf7928703ce59a84e65

SHA512
bc36fba4765771776c851811d9b6298725aa7b84646fea0b9845dd789839624e3a2b5ce5d55380b9ab39ee782530235fda55da65043217542c6e7514f8be9c79

Download Submit
C:\Windows\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe

Filesize
372KB

MD5
b84bc40fb2cee2347444a07502eddc3e

SHA1
0f7a9ae32805f8fd955b88dfff9e54316c811e7f

SHA256
ee1f710f541c3f2bf8da6e93c71a0d0087d2635a6ce6d26995cbf9a1d950769a

SHA512
b547b1797b56a2900c33e48b37ea123fd35e220fe543582401fbe717b8255aa3a3194f45ebe668bf0a6c1f9d9be5ad722f857adcb7ba88b1e5ec34d10c483380

Download Submit
C:\Windows\{D7C49D4B-7CDD-488f-B0C1-736C064D1021}.exe

Filesize
372KB

MD5
b84bc40fb2cee2347444a07502eddc3e

SHA1
0f7a9ae32805f8fd955b88dfff9e54316c811e7f

SHA256
ee1f710f541c3f2bf8da6e93c71a0d0087d2635a6ce6d26995cbf9a1d950769a

SHA512
b547b1797b56a2900c33e48b37ea123fd35e220fe543582401fbe717b8255aa3a3194f45ebe668bf0a6c1f9d9be5ad722f857adcb7ba88b1e5ec34d10c483380

Download Submit
C:\Windows\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe

Filesize
372KB

MD5
c94dbe982c6113543d1b2925455d2cea

SHA1
ccd7bd47d3af7be0571ecbda5ae81aaa443a9876

SHA256
72919c2fcdd16e9a01b92a4c1458044dd422df2228629def1452623c3fb5522f

SHA512
707638d2ab02cb184109ed159dbc6bacdb79387209e24e9bcaf426b1eef64ddb1ce3ddea2722bbcd66f6a12fd752bbbe5322f1f27670a071f352b4a6fa8f2ec1

Download Submit
C:\Windows\{DBF467E6-F0D8-470c-9C58-C913CC836B47}.exe

Filesize
372KB

MD5
c94dbe982c6113543d1b2925455d2cea

SHA1
ccd7bd47d3af7be0571ecbda5ae81aaa443a9876

SHA256
72919c2fcdd16e9a01b92a4c1458044dd422df2228629def1452623c3fb5522f

SHA512
707638d2ab02cb184109ed159dbc6bacdb79387209e24e9bcaf426b1eef64ddb1ce3ddea2722bbcd66f6a12fd752bbbe5322f1f27670a071f352b4a6fa8f2ec1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads