aa8c271ab83b722a364e077825bfdecb8c315bfa40c86cc86c3d782ead6fbcce

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
Size

372KB
MD5

56a450acf27eac20015f8b8bcef4bea2
SHA1

87327e9b975e7f2a580ac658859cfa79ef6e9367
SHA256

aa8c271ab83b722a364e077825bfdecb8c315bfa40c86cc86c3d782ead6fbcce
SHA512

8ac1e1d3999763fb3961de4604abb8cc49c85138eb8403697e53464333a40a3ba210297110c1c5b2221e34fbac12adafc2ece7d706f9d8b5138f0ecd629108fb
SSDEEP

3072:CEGh0oCmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGNl/Oe2MUVg3vTeKcAEciTBqr3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15247AB3-120A-412f-A128-EF077549CC3B}	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5515ABA-70E9-40f5-A7FC-D28920453714}	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5515ABA-70E9-40f5-A7FC-D28920453714}\stubpath = "C:\\Windows\\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe"	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7057212F-C1F5-4af5-8747-8D22DE446B79}	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7057212F-C1F5-4af5-8747-8D22DE446B79}\stubpath = "C:\\Windows\\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe"	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}\stubpath = "C:\\Windows\\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe"	{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15247AB3-120A-412f-A128-EF077549CC3B}\stubpath = "C:\\Windows\\{15247AB3-120A-412f-A128-EF077549CC3B}.exe"	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}\stubpath = "C:\\Windows\\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe"	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18B645ED-3694-4e8e-A255-7B27163771CB}	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7187870-05F8-4f0f-AC6C-687190ED02A1}	{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7187870-05F8-4f0f-AC6C-687190ED02A1}\stubpath = "C:\\Windows\\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe"	{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}	{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23306A6E-0509-409c-82D5-AA20745D0911}	{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}\stubpath = "C:\\Windows\\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe"	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}\stubpath = "C:\\Windows\\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe"	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}	{15247AB3-120A-412f-A128-EF077549CC3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}\stubpath = "C:\\Windows\\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe"	{15247AB3-120A-412f-A128-EF077549CC3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18B645ED-3694-4e8e-A255-7B27163771CB}\stubpath = "C:\\Windows\\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe"	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23306A6E-0509-409c-82D5-AA20745D0911}\stubpath = "C:\\Windows\\{23306A6E-0509-409c-82D5-AA20745D0911}.exe"	{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe

Deletes itself 1 IoCs

pid	Process
2052	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe
2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
1064	{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
1408	{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
2752	{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe
1924	{23306A6E-0509-409c-82D5-AA20745D0911}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	{15247AB3-120A-412f-A128-EF077549CC3B}.exe
File created	C:\Windows\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
File created	C:\Windows\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
File created	C:\Windows\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe	{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
File created	C:\Windows\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe	{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
File created	C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
File created	C:\Windows\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
File created	C:\Windows\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
File created	C:\Windows\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
File created	C:\Windows\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
File created	C:\Windows\{23306A6E-0509-409c-82D5-AA20745D0911}.exe	{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe
Token: SeIncBasePriorityPrivilege	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
Token: SeIncBasePriorityPrivilege	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
Token: SeIncBasePriorityPrivilege	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
Token: SeIncBasePriorityPrivilege	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
Token: SeIncBasePriorityPrivilege	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
Token: SeIncBasePriorityPrivilege	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
Token: SeIncBasePriorityPrivilege	1064	{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
Token: SeIncBasePriorityPrivilege	1408	{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
Token: SeIncBasePriorityPrivilege	2752	{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2220	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	30
PID 2224 wrote to memory of 2220	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	30
PID 2224 wrote to memory of 2220	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	30
PID 2224 wrote to memory of 2220	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	30
PID 2224 wrote to memory of 2052	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	31
PID 2224 wrote to memory of 2052	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	31
PID 2224 wrote to memory of 2052	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	31
PID 2224 wrote to memory of 2052	2224	56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe	31
PID 2220 wrote to memory of 2208	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	32
PID 2220 wrote to memory of 2208	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	32
PID 2220 wrote to memory of 2208	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	32
PID 2220 wrote to memory of 2208	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	32
PID 2220 wrote to memory of 2272	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	33
PID 2220 wrote to memory of 2272	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	33
PID 2220 wrote to memory of 2272	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	33
PID 2220 wrote to memory of 2272	2220	{15247AB3-120A-412f-A128-EF077549CC3B}.exe	33
PID 2208 wrote to memory of 2648	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	35
PID 2208 wrote to memory of 2648	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	35
PID 2208 wrote to memory of 2648	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	35
PID 2208 wrote to memory of 2648	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	35
PID 2208 wrote to memory of 1916	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	34
PID 2208 wrote to memory of 1916	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	34
PID 2208 wrote to memory of 1916	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	34
PID 2208 wrote to memory of 1916	2208	{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe	34
PID 2648 wrote to memory of 2792	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	36
PID 2648 wrote to memory of 2792	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	36
PID 2648 wrote to memory of 2792	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	36
PID 2648 wrote to memory of 2792	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	36
PID 2648 wrote to memory of 2344	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	37
PID 2648 wrote to memory of 2344	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	37
PID 2648 wrote to memory of 2344	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	37
PID 2648 wrote to memory of 2344	2648	{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe	37
PID 2792 wrote to memory of 2940	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	38
PID 2792 wrote to memory of 2940	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	38
PID 2792 wrote to memory of 2940	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	38
PID 2792 wrote to memory of 2940	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	38
PID 2792 wrote to memory of 2968	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	39
PID 2792 wrote to memory of 2968	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	39
PID 2792 wrote to memory of 2968	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	39
PID 2792 wrote to memory of 2968	2792	{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe	39
PID 2940 wrote to memory of 2856	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	40
PID 2940 wrote to memory of 2856	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	40
PID 2940 wrote to memory of 2856	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	40
PID 2940 wrote to memory of 2856	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	40
PID 2940 wrote to memory of 1900	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	41
PID 2940 wrote to memory of 1900	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	41
PID 2940 wrote to memory of 1900	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	41
PID 2940 wrote to memory of 1900	2940	{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe	41
PID 2856 wrote to memory of 2832	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	43
PID 2856 wrote to memory of 2832	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	43
PID 2856 wrote to memory of 2832	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	43
PID 2856 wrote to memory of 2832	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	43
PID 2856 wrote to memory of 2868	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	42
PID 2856 wrote to memory of 2868	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	42
PID 2856 wrote to memory of 2868	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	42
PID 2856 wrote to memory of 2868	2856	{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe	42
PID 2832 wrote to memory of 1064	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	44
PID 2832 wrote to memory of 1064	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	44
PID 2832 wrote to memory of 1064	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	44
PID 2832 wrote to memory of 1064	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	44
PID 2832 wrote to memory of 2676	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	45
PID 2832 wrote to memory of 2676	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	45
PID 2832 wrote to memory of 2676	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	45
PID 2832 wrote to memory of 2676	2832	{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe	45

C:\Users\Admin\AppData\Local\Temp\56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\56a450acf27eac20015f8b8bcef4bea2_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe
  C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
    C:\Windows\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F7736~1.EXE > nul
      4⤵
      PID:1916
  - - C:\Windows\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
      C:\Windows\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
        
        C:\Windows\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
      - C:\Windows\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
        
        C:\Windows\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
        
        C:\Windows\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5515~1.EXE > nul
        8⤵
        
        PID:2868
        
        C:\Windows\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
        
        C:\Windows\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
        
        C:\Windows\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
        
        C:\Windows\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
        
        C:\Windows\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe
        
        C:\Windows\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\{23306A6E-0509-409c-82D5-AA20745D0911}.exe
        
        C:\Windows\{23306A6E-0509-409c-82D5-AA20745D0911}.exe
        12⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1034E~1.EXE > nul
        12⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7187~1.EXE > nul
        11⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18B64~1.EXE > nul
        10⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70572~1.EXE > nul
        9⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31E2F~1.EXE > nul
        7⤵
        
        PID:1900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42565~1.EXE > nul
        6⤵
        
        PID:2968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE32E~1.EXE > nul
        5⤵
        
        PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{15247~1.EXE > nul
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\56A450~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe

Filesize
372KB

MD5
e7850295f6b13ec9599abc3e0e2c6fd6

SHA1
f70baf497dfa0ff15253a971d818146b27f3816e

SHA256
5bd5cf7a29f1b25435716738e31097e1c5d49d7cf5934c035812134c7c6df21b

SHA512
0f13ba996c6b3e102851fe30ae43875ad9bbeeac3543ebc2728b192541259e5796d86a0c5c3a337b74b1583f9093e499ba707079e96de47022d882f7b66e738b

Download Submit
C:\Windows\{1034EFEC-0C02-4e4d-AB71-FE4E7E88CE93}.exe

Filesize
372KB

MD5
e7850295f6b13ec9599abc3e0e2c6fd6

SHA1
f70baf497dfa0ff15253a971d818146b27f3816e

SHA256
5bd5cf7a29f1b25435716738e31097e1c5d49d7cf5934c035812134c7c6df21b

SHA512
0f13ba996c6b3e102851fe30ae43875ad9bbeeac3543ebc2728b192541259e5796d86a0c5c3a337b74b1583f9093e499ba707079e96de47022d882f7b66e738b

Download Submit
C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe

Filesize
372KB

MD5
0133143bb3fcd471e6ded29d292d820a

SHA1
8a6d6f4817e4c2fb871426fd0bed3d3ee3ddec8d

SHA256
0ae816cf4a36248db2fa9018cc44e7a97da932b0f6687359d3a606dfdd19da72

SHA512
7ebceb55dc976b0d4daa3c7faae35a8aab5132683ad0636e966acdca5323bfea5604b89fa73d0a2d4adc3cbe4d2612baac3be277cf9900c91726f3c3fe876c7a

Download Submit
C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe

Filesize
372KB

MD5
0133143bb3fcd471e6ded29d292d820a

SHA1
8a6d6f4817e4c2fb871426fd0bed3d3ee3ddec8d

SHA256
0ae816cf4a36248db2fa9018cc44e7a97da932b0f6687359d3a606dfdd19da72

SHA512
7ebceb55dc976b0d4daa3c7faae35a8aab5132683ad0636e966acdca5323bfea5604b89fa73d0a2d4adc3cbe4d2612baac3be277cf9900c91726f3c3fe876c7a

Download Submit
C:\Windows\{15247AB3-120A-412f-A128-EF077549CC3B}.exe

Filesize
372KB

MD5
0133143bb3fcd471e6ded29d292d820a

SHA1
8a6d6f4817e4c2fb871426fd0bed3d3ee3ddec8d

SHA256
0ae816cf4a36248db2fa9018cc44e7a97da932b0f6687359d3a606dfdd19da72

SHA512
7ebceb55dc976b0d4daa3c7faae35a8aab5132683ad0636e966acdca5323bfea5604b89fa73d0a2d4adc3cbe4d2612baac3be277cf9900c91726f3c3fe876c7a

Download Submit
C:\Windows\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe

Filesize
372KB

MD5
9b56ecb169ecbbf3c8f2adc0e5c7acd4

SHA1
9cde067671602f6862c4c5d7e9ba674e5f70bd79

SHA256
3ffc69aff11b4c52bf335351ac91a3d9e8e4d8e5e9b2f65a2b95fcde396ddaf4

SHA512
d9ca1e989f42e67281cb0432aaace1bbe759cb0012876967f21e2ed0ef67a649b06a10c80becb06865fb3bb3a3074527b27c81a7d2a52149b2100adc10eeeee7

Download Submit
C:\Windows\{18B645ED-3694-4e8e-A255-7B27163771CB}.exe

Filesize
372KB

MD5
9b56ecb169ecbbf3c8f2adc0e5c7acd4

SHA1
9cde067671602f6862c4c5d7e9ba674e5f70bd79

SHA256
3ffc69aff11b4c52bf335351ac91a3d9e8e4d8e5e9b2f65a2b95fcde396ddaf4

SHA512
d9ca1e989f42e67281cb0432aaace1bbe759cb0012876967f21e2ed0ef67a649b06a10c80becb06865fb3bb3a3074527b27c81a7d2a52149b2100adc10eeeee7

Download Submit
C:\Windows\{23306A6E-0509-409c-82D5-AA20745D0911}.exe

Filesize
372KB

MD5
7f778a31e48235412def4d6599b3a113

SHA1
568ad3d11c9468f17701f216015c3f471fdfe3ef

SHA256
79719c962ae6eada64af51b111c013e64c788644df533a3992a5a8a6ae2016a8

SHA512
63cce3c8c6c262165f54cd4556c088eb839f413521bc04f06f3f5908e8b3079334748f8d6fdf6d1d3c402e4d77b6f5a67cee80152e8803a712e652873882ff64

Download Submit
C:\Windows\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe

Filesize
372KB

MD5
0c8e624a9b90c297e30776bd991d43c7

SHA1
20eb8ae7d63fb4c8bf029f82945f9674673f1a2c

SHA256
1621f584c08ab5a87011d6ed38493e236577f6c613282c91c554217c74889bdc

SHA512
ebe108360435b749ee750d995a8f0256e02dfc289a785422cda041c0d189142ecbf20aef9fd0ff501eda2ddb26b4f0d8e597a1c92fa5d7f8c69a6cf0be4969cf

Download Submit
C:\Windows\{31E2F2B8-7A5A-4919-9FD2-7E91F860327B}.exe

Filesize
372KB

MD5
0c8e624a9b90c297e30776bd991d43c7

SHA1
20eb8ae7d63fb4c8bf029f82945f9674673f1a2c

SHA256
1621f584c08ab5a87011d6ed38493e236577f6c613282c91c554217c74889bdc

SHA512
ebe108360435b749ee750d995a8f0256e02dfc289a785422cda041c0d189142ecbf20aef9fd0ff501eda2ddb26b4f0d8e597a1c92fa5d7f8c69a6cf0be4969cf

Download Submit
C:\Windows\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe

Filesize
372KB

MD5
4d80852e83ca0220bb3b58de0eee9678

SHA1
f57dd4e15b4cb9562b9b81b4237b9fd0e0704616

SHA256
ff4f3c3126f70b6a337f3df76ab5a23945d68d596ce173d01b6bca547c85ac92

SHA512
94ec582067f3aa418a2aaf869484c43112b2271ce053bb1851a01890efcb5ac0d3faeadc49c6808ae6f669d65a987b8eb3c3eb69d58d3f2859e93d5a019a47f2

Download Submit
C:\Windows\{42565CA4-C6C2-4037-9B0F-09EB9EB5928D}.exe

Filesize
372KB

MD5
4d80852e83ca0220bb3b58de0eee9678

SHA1
f57dd4e15b4cb9562b9b81b4237b9fd0e0704616

SHA256
ff4f3c3126f70b6a337f3df76ab5a23945d68d596ce173d01b6bca547c85ac92

SHA512
94ec582067f3aa418a2aaf869484c43112b2271ce053bb1851a01890efcb5ac0d3faeadc49c6808ae6f669d65a987b8eb3c3eb69d58d3f2859e93d5a019a47f2

Download Submit
C:\Windows\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe

Filesize
372KB

MD5
2730500b8ab7d8a0890d53916b05ea5f

SHA1
797569c01826582fbad7ff14b50116a7d82d3065

SHA256
a3509e738105a01eaf0af5af0f2972063e9f00d318973cc9a98913ac99085473

SHA512
86a456ef9c0c9da61c8d8f6cd8733c72a1ddf855dfec25c8f924126bfb738d2fbcf5e3cc9f37d4c01423f4b400fbacd6a7795b0496f642f452ef0125e04c0287

Download Submit
C:\Windows\{7057212F-C1F5-4af5-8747-8D22DE446B79}.exe

Filesize
372KB

MD5
2730500b8ab7d8a0890d53916b05ea5f

SHA1
797569c01826582fbad7ff14b50116a7d82d3065

SHA256
a3509e738105a01eaf0af5af0f2972063e9f00d318973cc9a98913ac99085473

SHA512
86a456ef9c0c9da61c8d8f6cd8733c72a1ddf855dfec25c8f924126bfb738d2fbcf5e3cc9f37d4c01423f4b400fbacd6a7795b0496f642f452ef0125e04c0287

Download Submit
C:\Windows\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe

Filesize
372KB

MD5
057752c4744873c31a5127d87ce41317

SHA1
4f49a933b2ed84773c167df9161883a0df525ef1

SHA256
7675d96bd5370358ea8fe138da68cd87f036c457d427f5655dcf4770d794a136

SHA512
ea82bb926737566f19288c2e55cf79bac12ad071083d378b015c91a0ad6d8482af8cbe9ba6cf834abb2001d0b8c21103a4e2dd0924aa645de8f591eaeb5a1b70

Download Submit
C:\Windows\{C5515ABA-70E9-40f5-A7FC-D28920453714}.exe

Filesize
372KB

MD5
057752c4744873c31a5127d87ce41317

SHA1
4f49a933b2ed84773c167df9161883a0df525ef1

SHA256
7675d96bd5370358ea8fe138da68cd87f036c457d427f5655dcf4770d794a136

SHA512
ea82bb926737566f19288c2e55cf79bac12ad071083d378b015c91a0ad6d8482af8cbe9ba6cf834abb2001d0b8c21103a4e2dd0924aa645de8f591eaeb5a1b70

Download Submit
C:\Windows\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe

Filesize
372KB

MD5
c6b97558461b212f5eebb6e5990244c0

SHA1
c5fe3a47db6576d14487df375e33e9eeb65a6de4

SHA256
9bedbfd660290c0067ea36388a8015cbb48cfe9e86dc755e5f80fe4f84728a91

SHA512
5705702b39898434380bd7bafd12f381fa5b736ca79d02f9fae931ddacdb1c18aeabe4fbaceef23a0d4b1bf078510c6b442070e722913c6f143a5df67b559c4a

Download Submit
C:\Windows\{CE32E04C-030A-4f8d-B95D-8BA6AB4CF746}.exe

Filesize
372KB

MD5
c6b97558461b212f5eebb6e5990244c0

SHA1
c5fe3a47db6576d14487df375e33e9eeb65a6de4

SHA256
9bedbfd660290c0067ea36388a8015cbb48cfe9e86dc755e5f80fe4f84728a91

SHA512
5705702b39898434380bd7bafd12f381fa5b736ca79d02f9fae931ddacdb1c18aeabe4fbaceef23a0d4b1bf078510c6b442070e722913c6f143a5df67b559c4a

Download Submit
C:\Windows\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe

Filesize
372KB

MD5
1315ca5a15dfa2f436fa89b870636bde

SHA1
d2554de7004fba0af8b0690d1f9b116c22de419b

SHA256
a37374b7e8326005427b45387a75ca9ee0ad682f4a9649ea05795fa61c79689e

SHA512
328b382658543966a414e2c17be283d3e9e35499f734ded79d111099781786763f6f035ae5dd7e5d2553b6d59e5a0f0abf43fd671db3b2ab96afe4c33090cc6c

Download Submit
C:\Windows\{E7187870-05F8-4f0f-AC6C-687190ED02A1}.exe

Filesize
372KB

MD5
1315ca5a15dfa2f436fa89b870636bde

SHA1
d2554de7004fba0af8b0690d1f9b116c22de419b

SHA256
a37374b7e8326005427b45387a75ca9ee0ad682f4a9649ea05795fa61c79689e

SHA512
328b382658543966a414e2c17be283d3e9e35499f734ded79d111099781786763f6f035ae5dd7e5d2553b6d59e5a0f0abf43fd671db3b2ab96afe4c33090cc6c

Download Submit
C:\Windows\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe

Filesize
372KB

MD5
62d1ccf252e56b592aa9fd98de4a6849

SHA1
ac8345f994eae714d14f7b858339c1ad5b59eb2d

SHA256
9cad6f707f7bfe5295580299fd09c940f8cc9e5b9f2b0e8b7da51c0ecd036567

SHA512
69c448091fdb8df57ef321bb8015d5f757ce04a3265eb02e9039be4d916f00862157d73976e948cccca30d3b417c90f28150493c4ee24b9d1d52e3c5a3251f91

Download Submit
C:\Windows\{F7736104-A4C8-49f3-BE2C-1D85331EB1A9}.exe

Filesize
372KB

MD5
62d1ccf252e56b592aa9fd98de4a6849

SHA1
ac8345f994eae714d14f7b858339c1ad5b59eb2d

SHA256
9cad6f707f7bfe5295580299fd09c940f8cc9e5b9f2b0e8b7da51c0ecd036567

SHA512
69c448091fdb8df57ef321bb8015d5f757ce04a3265eb02e9039be4d916f00862157d73976e948cccca30d3b417c90f28150493c4ee24b9d1d52e3c5a3251f91

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads