0f3633c88981194c09a704a955e1ee4d4c9ee7b5c6547f546833bfb724fff679

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/08/2023, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
Size

408KB
MD5

672707dbc0c79114cd80b2814aab64b8
SHA1

86c6ee155be50deb4d88f99f24ddd9eaa8f47a9f
SHA256

0f3633c88981194c09a704a955e1ee4d4c9ee7b5c6547f546833bfb724fff679
SHA512

2bbec7b0dd161b12c2ba8f10618d9344c9c375eadf8f2e095f63a6be8bfc541283f357d1f0fac0b5323cb6ad34d109a78996f96872adc0bb8d0ec6ade1346bf7
SSDEEP

3072:CEGh0oll3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGrldOe2MUVg3vTeKcAEciTBqr3jy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}\stubpath = "C:\\Windows\\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe"	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}\stubpath = "C:\\Windows\\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe"	{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D0FC091-454A-4777-A1A9-8C69363B999F}	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2626BC73-4739-4c1a-B215-FCC02E53D827}\stubpath = "C:\\Windows\\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe"	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}	{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}\stubpath = "C:\\Windows\\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe"	{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D0FC091-454A-4777-A1A9-8C69363B999F}\stubpath = "C:\\Windows\\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe"	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2626BC73-4739-4c1a-B215-FCC02E53D827}	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}\stubpath = "C:\\Windows\\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe"	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}\stubpath = "C:\\Windows\\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe"	{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}	{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}\stubpath = "C:\\Windows\\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe"	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}\stubpath = "C:\\Windows\\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe"	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF96AAE2-5E82-4228-9892-02558E94CD27}\stubpath = "C:\\Windows\\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe"	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}	{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}\stubpath = "C:\\Windows\\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe"	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF96AAE2-5E82-4228-9892-02558E94CD27}	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
1124	{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
2912	{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
3064	{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
2772	{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
File created	C:\Windows\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
File created	C:\Windows\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
File created	C:\Windows\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
File created	C:\Windows\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
File created	C:\Windows\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
File created	C:\Windows\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe	{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
File created	C:\Windows\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
File created	C:\Windows\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
File created	C:\Windows\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe	{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
File created	C:\Windows\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe	{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
Token: SeIncBasePriorityPrivilege	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
Token: SeIncBasePriorityPrivilege	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
Token: SeIncBasePriorityPrivilege	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
Token: SeIncBasePriorityPrivilege	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
Token: SeIncBasePriorityPrivilege	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
Token: SeIncBasePriorityPrivilege	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
Token: SeIncBasePriorityPrivilege	1124	{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
Token: SeIncBasePriorityPrivilege	2912	{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
Token: SeIncBasePriorityPrivilege	3064	{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1892	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	28
PID 2604 wrote to memory of 1892	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	28
PID 2604 wrote to memory of 1892	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	28
PID 2604 wrote to memory of 1892	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	28
PID 2604 wrote to memory of 2804	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	29
PID 2604 wrote to memory of 2804	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	29
PID 2604 wrote to memory of 2804	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	29
PID 2604 wrote to memory of 2804	2604	672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe	29
PID 1892 wrote to memory of 2968	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	32
PID 1892 wrote to memory of 2968	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	32
PID 1892 wrote to memory of 2968	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	32
PID 1892 wrote to memory of 2968	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	32
PID 1892 wrote to memory of 2960	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	33
PID 1892 wrote to memory of 2960	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	33
PID 1892 wrote to memory of 2960	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	33
PID 1892 wrote to memory of 2960	1892	{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe	33
PID 2968 wrote to memory of 2744	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	34
PID 2968 wrote to memory of 2744	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	34
PID 2968 wrote to memory of 2744	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	34
PID 2968 wrote to memory of 2744	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	34
PID 2968 wrote to memory of 2924	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	35
PID 2968 wrote to memory of 2924	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	35
PID 2968 wrote to memory of 2924	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	35
PID 2968 wrote to memory of 2924	2968	{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe	35
PID 2744 wrote to memory of 2884	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	36
PID 2744 wrote to memory of 2884	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	36
PID 2744 wrote to memory of 2884	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	36
PID 2744 wrote to memory of 2884	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	36
PID 2744 wrote to memory of 2824	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	37
PID 2744 wrote to memory of 2824	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	37
PID 2744 wrote to memory of 2824	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	37
PID 2744 wrote to memory of 2824	2744	{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe	37
PID 2884 wrote to memory of 2724	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	38
PID 2884 wrote to memory of 2724	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	38
PID 2884 wrote to memory of 2724	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	38
PID 2884 wrote to memory of 2724	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	38
PID 2884 wrote to memory of 2776	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	39
PID 2884 wrote to memory of 2776	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	39
PID 2884 wrote to memory of 2776	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	39
PID 2884 wrote to memory of 2776	2884	{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe	39
PID 2724 wrote to memory of 2372	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	40
PID 2724 wrote to memory of 2372	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	40
PID 2724 wrote to memory of 2372	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	40
PID 2724 wrote to memory of 2372	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	40
PID 2724 wrote to memory of 2528	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	41
PID 2724 wrote to memory of 2528	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	41
PID 2724 wrote to memory of 2528	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	41
PID 2724 wrote to memory of 2528	2724	{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe	41
PID 2372 wrote to memory of 1196	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	42
PID 2372 wrote to memory of 1196	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	42
PID 2372 wrote to memory of 1196	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	42
PID 2372 wrote to memory of 1196	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	42
PID 2372 wrote to memory of 580	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	43
PID 2372 wrote to memory of 580	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	43
PID 2372 wrote to memory of 580	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	43
PID 2372 wrote to memory of 580	2372	{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe	43
PID 1196 wrote to memory of 1124	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	44
PID 1196 wrote to memory of 1124	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	44
PID 1196 wrote to memory of 1124	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	44
PID 1196 wrote to memory of 1124	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	44
PID 1196 wrote to memory of 1448	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	45
PID 1196 wrote to memory of 1448	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	45
PID 1196 wrote to memory of 1448	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	45
PID 1196 wrote to memory of 1448	1196	{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe	45

C:\Users\Admin\AppData\Local\Temp\672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\672707dbc0c79114cd80b2814aab64b8_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
  C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
    C:\Windows\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
      C:\Windows\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
        
        C:\Windows\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
        
        C:\Windows\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
        
        C:\Windows\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
        
        C:\Windows\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
        
        C:\Windows\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
        
        C:\Windows\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
        
        C:\Windows\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe
        
        C:\Windows\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe
        12⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{93DF9~1.EXE > nul
        12⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE7BF~1.EXE > nul
        11⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A394~1.EXE > nul
        10⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A1B5~1.EXE > nul
        9⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF96A~1.EXE > nul
        8⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25BCD~1.EXE > nul
        7⤵
        
        PID:2528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2626B~1.EXE > nul
        6⤵
        
        PID:2776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D0FC~1.EXE > nul
        5⤵
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6C3C8~1.EXE > nul
      4⤵
      PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A6DD7~1.EXE > nul
    3⤵
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\672707~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe

Filesize
408KB

MD5
75e6645813cdd92c6b1b528f1014f311

SHA1
f78b4c5c247022367fe4f70ba0e2152dd6afef71

SHA256
d37771e0a2b3fa81de57c6dfb34866ba0fe3774ed5ea56a1891cbd322ba84bf3

SHA512
6c8decb0485d2cab823f8a4777df587b6385f0fe1ea21eb9295d8d6b2c1e6cbdab794f776f6f7b54fc50ea46f46aaadecc0e6ed9896c2909c5cdf7ee4a767fbc

Download Submit
C:\Windows\{1A394BCB-28D4-4b8a-AA92-1405A827F6A8}.exe

Filesize
408KB

MD5
75e6645813cdd92c6b1b528f1014f311

SHA1
f78b4c5c247022367fe4f70ba0e2152dd6afef71

SHA256
d37771e0a2b3fa81de57c6dfb34866ba0fe3774ed5ea56a1891cbd322ba84bf3

SHA512
6c8decb0485d2cab823f8a4777df587b6385f0fe1ea21eb9295d8d6b2c1e6cbdab794f776f6f7b54fc50ea46f46aaadecc0e6ed9896c2909c5cdf7ee4a767fbc

Download Submit
C:\Windows\{24D196C5-FA0F-4e2e-AFDB-4A79CD15558D}.exe

Filesize
408KB

MD5
5f2aaef62d1507f86efca3780136f9d4

SHA1
067ca5e3be09f79e2dbdb02c0476b9972c8a7975

SHA256
3517c2fbe0b6a44de349ab8272ded59b3069caac70163f12669542a3d95ff89a

SHA512
d813493c444c13cbf93217da2a26dc5ede7f4cfd75cf278b6dd96ae6f1d6e5d0a886bb3725eb9aa47fa63dd238d98d34be850d2219b03ce5385abf67ba07d636

Download Submit
C:\Windows\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe

Filesize
408KB

MD5
b994b83f88e6e32259001031e1044d01

SHA1
998e85e65bb3bfc51700aa34a04cbff3b959e1a0

SHA256
822ddd321f862184858a0c393348c75b144f5504a625e03def5e3b5ffd537b53

SHA512
cbcb56970f6ee2011641dee96342dc44254048b219a8a1ee8d05a1210712ec7aad1fd9fd2f451cf7e2d17d6de899f5bcbe1e946688d86a8bb1b9518f57406b07

Download Submit
C:\Windows\{25BCD7F7-A97E-4f56-9B18-1B5CE30D4C17}.exe

Filesize
408KB

MD5
b994b83f88e6e32259001031e1044d01

SHA1
998e85e65bb3bfc51700aa34a04cbff3b959e1a0

SHA256
822ddd321f862184858a0c393348c75b144f5504a625e03def5e3b5ffd537b53

SHA512
cbcb56970f6ee2011641dee96342dc44254048b219a8a1ee8d05a1210712ec7aad1fd9fd2f451cf7e2d17d6de899f5bcbe1e946688d86a8bb1b9518f57406b07

Download Submit
C:\Windows\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe

Filesize
408KB

MD5
a078161fcbc033868dc932eb0bc42947

SHA1
a849f7589673040e9f9a8cfb466f3242da8d5508

SHA256
f15c84238c9287cbec45c31324772f79f1f06754f33685c6bb634014d3a6d622

SHA512
8f0f0c6049aeac95e0dce69c183d207ba67dd389aa0751c02650e820b5fa89a8769afc70e2025c623b544ed97bc98550280474ff44132744b554015f2f4dcd5d

Download Submit
C:\Windows\{2626BC73-4739-4c1a-B215-FCC02E53D827}.exe

Filesize
408KB

MD5
a078161fcbc033868dc932eb0bc42947

SHA1
a849f7589673040e9f9a8cfb466f3242da8d5508

SHA256
f15c84238c9287cbec45c31324772f79f1f06754f33685c6bb634014d3a6d622

SHA512
8f0f0c6049aeac95e0dce69c183d207ba67dd389aa0751c02650e820b5fa89a8769afc70e2025c623b544ed97bc98550280474ff44132744b554015f2f4dcd5d

Download Submit
C:\Windows\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe

Filesize
408KB

MD5
edeee69ae83930b6c0b6692088d9365f

SHA1
576d3fe57c94df0160c378b08a59519e766dcab8

SHA256
02e9fc6096374d3fd84226e6a17065967daf19260a1f3bacb0af390d3deae02c

SHA512
b08281c4d18fc3b1ee922a6c6a6161d19cc246a26cae03b87dc87c6e0fae99548d30b7bfcf1f8758e218083eabb9e7650ece4ea63c8238d67395c270298bd1a9

Download Submit
C:\Windows\{5D0FC091-454A-4777-A1A9-8C69363B999F}.exe

Filesize
408KB

MD5
edeee69ae83930b6c0b6692088d9365f

SHA1
576d3fe57c94df0160c378b08a59519e766dcab8

SHA256
02e9fc6096374d3fd84226e6a17065967daf19260a1f3bacb0af390d3deae02c

SHA512
b08281c4d18fc3b1ee922a6c6a6161d19cc246a26cae03b87dc87c6e0fae99548d30b7bfcf1f8758e218083eabb9e7650ece4ea63c8238d67395c270298bd1a9

Download Submit
C:\Windows\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe

Filesize
408KB

MD5
faa44359b72fa50642557a16eaf1a66c

SHA1
d8da1e00bf85d8ce18fb90842d2724a2860f6434

SHA256
76763072b20a79ad78af51a92f2a0851e20a352519ac81cc1a38cb635571becc

SHA512
3aabe9ddfb730669a9592040745c7663a3a373615ccd64d3f74da0dda04d3be08be20899b0f5fe5b749f85e1157ae7d794b796b0fdccc702153e608fd7ff9652

Download Submit
C:\Windows\{6A1B556B-0A25-4ed0-BCF7-E4F358469360}.exe

Filesize
408KB

MD5
faa44359b72fa50642557a16eaf1a66c

SHA1
d8da1e00bf85d8ce18fb90842d2724a2860f6434

SHA256
76763072b20a79ad78af51a92f2a0851e20a352519ac81cc1a38cb635571becc

SHA512
3aabe9ddfb730669a9592040745c7663a3a373615ccd64d3f74da0dda04d3be08be20899b0f5fe5b749f85e1157ae7d794b796b0fdccc702153e608fd7ff9652

Download Submit
C:\Windows\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe

Filesize
408KB

MD5
0cf6921d07f60e8680f302fe5e12788a

SHA1
7c70a64196b1761e20cdcbf759fae0d32d2d0e65

SHA256
84e59717e583181dd9d2900eaf2878a606286f0c88c82b32cee129097ffb7aec

SHA512
78154898be76ef4aae2103fd860a6c4ddd663475f7047565de0a900f4a1aa2dbd3f03a7dd1e0989cbc30e4f2963172869d1804f8e85731426e5f436815d7b5e5

Download Submit
C:\Windows\{6C3C85B7-85C5-4593-B19E-A6E88B6AA147}.exe

Filesize
408KB

MD5
0cf6921d07f60e8680f302fe5e12788a

SHA1
7c70a64196b1761e20cdcbf759fae0d32d2d0e65

SHA256
84e59717e583181dd9d2900eaf2878a606286f0c88c82b32cee129097ffb7aec

SHA512
78154898be76ef4aae2103fd860a6c4ddd663475f7047565de0a900f4a1aa2dbd3f03a7dd1e0989cbc30e4f2963172869d1804f8e85731426e5f436815d7b5e5

Download Submit
C:\Windows\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe

Filesize
408KB

MD5
7c2f3ac050191f7e1e8f714bf2b0a529

SHA1
cb28424f339793b7183549ead752613f7f3e9321

SHA256
9aaa3876b5b0791be945382c06ff02fdb38ad178a90add701fd0c45a9e49c0fc

SHA512
4f903130402fe936142e82b64de65a06c8f6db5455f93f0625e6a5d93ae60e7315215378522db788ab2d403ca851ca5a0ea7d2891bf73409d312038ea6f3a871

Download Submit
C:\Windows\{93DF91CE-263D-4cda-9C31-2AEC2C414FAB}.exe

Filesize
408KB

MD5
7c2f3ac050191f7e1e8f714bf2b0a529

SHA1
cb28424f339793b7183549ead752613f7f3e9321

SHA256
9aaa3876b5b0791be945382c06ff02fdb38ad178a90add701fd0c45a9e49c0fc

SHA512
4f903130402fe936142e82b64de65a06c8f6db5455f93f0625e6a5d93ae60e7315215378522db788ab2d403ca851ca5a0ea7d2891bf73409d312038ea6f3a871

Download Submit
C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe

Filesize
408KB

MD5
e235931b4b76122dc4ce4a43c359790b

SHA1
8936df3c7439c019d18f55da6d4e3532f4483dbe

SHA256
794d953c7dd093905a70e6848b787ba90be5d5ccde8b4f2599941e6a91e14915

SHA512
16692ba10fc7db6312c8075fa594f570ccee1f77184c65e4a8bb07c16296a53dae66f744117ad4ff7b6fee542020e7a84853988c69182bae33861be7934a210e

Download Submit
C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe

Filesize
408KB

MD5
e235931b4b76122dc4ce4a43c359790b

SHA1
8936df3c7439c019d18f55da6d4e3532f4483dbe

SHA256
794d953c7dd093905a70e6848b787ba90be5d5ccde8b4f2599941e6a91e14915

SHA512
16692ba10fc7db6312c8075fa594f570ccee1f77184c65e4a8bb07c16296a53dae66f744117ad4ff7b6fee542020e7a84853988c69182bae33861be7934a210e

Download Submit
C:\Windows\{A6DD75AF-1FA6-4973-94DF-4762D2EED4F1}.exe

Filesize
408KB

MD5
e235931b4b76122dc4ce4a43c359790b

SHA1
8936df3c7439c019d18f55da6d4e3532f4483dbe

SHA256
794d953c7dd093905a70e6848b787ba90be5d5ccde8b4f2599941e6a91e14915

SHA512
16692ba10fc7db6312c8075fa594f570ccee1f77184c65e4a8bb07c16296a53dae66f744117ad4ff7b6fee542020e7a84853988c69182bae33861be7934a210e

Download Submit
C:\Windows\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe

Filesize
408KB

MD5
dbfcbe8bce4c4687e9f3d79a4db55f5f

SHA1
0bfaa22fa7d1e0c7d21cfb748ca9b12e3554f628

SHA256
66b9c8204d77ee70d13106f3e801441f18a6d5200e3c2f4014429ec2fdf42112

SHA512
32b3a4e530ff1683caaba5d200cff107edd23eff9bec45460ba25eb2e8e76911bde551ec2ed706d85674c43ac9479144ea8020458ae66dad229f622b9ec56b1b

Download Submit
C:\Windows\{AF96AAE2-5E82-4228-9892-02558E94CD27}.exe

Filesize
408KB

MD5
dbfcbe8bce4c4687e9f3d79a4db55f5f

SHA1
0bfaa22fa7d1e0c7d21cfb748ca9b12e3554f628

SHA256
66b9c8204d77ee70d13106f3e801441f18a6d5200e3c2f4014429ec2fdf42112

SHA512
32b3a4e530ff1683caaba5d200cff107edd23eff9bec45460ba25eb2e8e76911bde551ec2ed706d85674c43ac9479144ea8020458ae66dad229f622b9ec56b1b

Download Submit
C:\Windows\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe

Filesize
408KB

MD5
af970746be868708af682c442f17bbf6

SHA1
de1dbe77bc056824c36eef2af5647beca44a9580

SHA256
dc4788baa84590b3860262e5bbf2ef685b14fb8864ddf4e0b92486901b1f80cc

SHA512
fefdd6edfd07478cdd64fb592b2f26d1c991e5b5bf62397a292945fcf6e90d48d0df289c7645812e977b525cd972d0423c4e028baf633233f8a13398abff393a

Download Submit
C:\Windows\{EE7BF2CC-2194-4f5c-8898-CCE42033C0A6}.exe

Filesize
408KB

MD5
af970746be868708af682c442f17bbf6

SHA1
de1dbe77bc056824c36eef2af5647beca44a9580

SHA256
dc4788baa84590b3860262e5bbf2ef685b14fb8864ddf4e0b92486901b1f80cc

SHA512
fefdd6edfd07478cdd64fb592b2f26d1c991e5b5bf62397a292945fcf6e90d48d0df289c7645812e977b525cd972d0423c4e028baf633233f8a13398abff393a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads