876beec99ed057e50de1ee13df4eb2931387d4f4fb14b03813a813838647480d

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
Size

372KB
MD5

afd4389748dd02cdfe81f7b66ca126ff
SHA1

95cfaa74ba9a7fc93da1233db155b62fe3bcc3a2
SHA256

876beec99ed057e50de1ee13df4eb2931387d4f4fb14b03813a813838647480d
SHA512

a3371f462ce1c799ad75e30f0d08727384fe76508266e4cebd57aac94cebba12aa979049686e8dd9042b491c11e47b4c2335a15511d87d98996d4dd9ce9454cb
SSDEEP

3072:CEGh0oymlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGtl/Oe2MUVg3vTeKcAEciTBqr3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89C869B2-AFED-4268-BF85-15C4680D7432}\stubpath = "C:\\Windows\\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe"	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}\stubpath = "C:\\Windows\\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe"	{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}\stubpath = "C:\\Windows\\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe"	{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89C869B2-AFED-4268-BF85-15C4680D7432}	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{532299D3-11CA-4d14-B4D2-AB0834A28B96}\stubpath = "C:\\Windows\\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe"	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}\stubpath = "C:\\Windows\\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe"	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}\stubpath = "C:\\Windows\\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe"	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8E024A1-152E-4929-B0D2-9619EF03A086}\stubpath = "C:\\Windows\\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe"	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}\stubpath = "C:\\Windows\\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe"	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}	{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}\stubpath = "C:\\Windows\\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe"	{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{532299D3-11CA-4d14-B4D2-AB0834A28B96}	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}\stubpath = "C:\\Windows\\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe"	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}	{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}	{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}\stubpath = "C:\\Windows\\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe"	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8E024A1-152E-4929-B0D2-9619EF03A086}	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
1636	{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
3020	{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
1716	{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
1212	{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
File created	C:\Windows\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
File created	C:\Windows\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
File created	C:\Windows\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe	{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
File created	C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
File created	C:\Windows\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
File created	C:\Windows\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
File created	C:\Windows\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
File created	C:\Windows\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe	{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
File created	C:\Windows\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe	{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
File created	C:\Windows\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
Token: SeIncBasePriorityPrivilege	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
Token: SeIncBasePriorityPrivilege	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
Token: SeIncBasePriorityPrivilege	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
Token: SeIncBasePriorityPrivilege	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
Token: SeIncBasePriorityPrivilege	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
Token: SeIncBasePriorityPrivilege	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
Token: SeIncBasePriorityPrivilege	1636	{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
Token: SeIncBasePriorityPrivilege	3020	{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
Token: SeIncBasePriorityPrivilege	1716	{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1720	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	28
PID 2304 wrote to memory of 1720	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	28
PID 2304 wrote to memory of 1720	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	28
PID 2304 wrote to memory of 1720	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	28
PID 2304 wrote to memory of 2836	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	29
PID 2304 wrote to memory of 2836	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	29
PID 2304 wrote to memory of 2836	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	29
PID 2304 wrote to memory of 2836	2304	afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe	29
PID 1720 wrote to memory of 3040	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	32
PID 1720 wrote to memory of 3040	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	32
PID 1720 wrote to memory of 3040	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	32
PID 1720 wrote to memory of 3040	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	32
PID 1720 wrote to memory of 2660	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	33
PID 1720 wrote to memory of 2660	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	33
PID 1720 wrote to memory of 2660	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	33
PID 1720 wrote to memory of 2660	1720	{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe	33
PID 3040 wrote to memory of 2288	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	34
PID 3040 wrote to memory of 2288	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	34
PID 3040 wrote to memory of 2288	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	34
PID 3040 wrote to memory of 2288	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	34
PID 3040 wrote to memory of 2260	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	35
PID 3040 wrote to memory of 2260	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	35
PID 3040 wrote to memory of 2260	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	35
PID 3040 wrote to memory of 2260	3040	{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe	35
PID 2288 wrote to memory of 2692	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	36
PID 2288 wrote to memory of 2692	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	36
PID 2288 wrote to memory of 2692	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	36
PID 2288 wrote to memory of 2692	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	36
PID 2288 wrote to memory of 2092	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	37
PID 2288 wrote to memory of 2092	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	37
PID 2288 wrote to memory of 2092	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	37
PID 2288 wrote to memory of 2092	2288	{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe	37
PID 2692 wrote to memory of 2768	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	38
PID 2692 wrote to memory of 2768	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	38
PID 2692 wrote to memory of 2768	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	38
PID 2692 wrote to memory of 2768	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	38
PID 2692 wrote to memory of 1296	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	39
PID 2692 wrote to memory of 1296	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	39
PID 2692 wrote to memory of 1296	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	39
PID 2692 wrote to memory of 1296	2692	{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe	39
PID 2768 wrote to memory of 2560	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	41
PID 2768 wrote to memory of 2560	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	41
PID 2768 wrote to memory of 2560	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	41
PID 2768 wrote to memory of 2560	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	41
PID 2768 wrote to memory of 760	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	40
PID 2768 wrote to memory of 760	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	40
PID 2768 wrote to memory of 760	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	40
PID 2768 wrote to memory of 760	2768	{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe	40
PID 2560 wrote to memory of 1464	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	43
PID 2560 wrote to memory of 1464	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	43
PID 2560 wrote to memory of 1464	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	43
PID 2560 wrote to memory of 1464	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	43
PID 2560 wrote to memory of 916	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	42
PID 2560 wrote to memory of 916	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	42
PID 2560 wrote to memory of 916	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	42
PID 2560 wrote to memory of 916	2560	{89C869B2-AFED-4268-BF85-15C4680D7432}.exe	42
PID 1464 wrote to memory of 1636	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	44
PID 1464 wrote to memory of 1636	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	44
PID 1464 wrote to memory of 1636	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	44
PID 1464 wrote to memory of 1636	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	44
PID 1464 wrote to memory of 304	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	45
PID 1464 wrote to memory of 304	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	45
PID 1464 wrote to memory of 304	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	45
PID 1464 wrote to memory of 304	1464	{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe	45

C:\Users\Admin\AppData\Local\Temp\afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\afd4389748dd02cdfe81f7b66ca126ff_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
  C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
    C:\Windows\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
      C:\Windows\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Windows\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
        
        C:\Windows\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
        
        C:\Windows\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E8E02~1.EXE > nul
        7⤵
        
        PID:760
        
        C:\Windows\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
        
        C:\Windows\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89C86~1.EXE > nul
        8⤵
        
        PID:916
        
        C:\Windows\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
        
        C:\Windows\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
        
        C:\Windows\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
        
        C:\Windows\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Windows\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
        
        C:\Windows\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe
        
        C:\Windows\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe
        12⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6DC16~1.EXE > nul
        12⤵
        
        PID:284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE1D5~1.EXE > nul
        11⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{745ED~1.EXE > nul
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADC15~1.EXE > nul
        9⤵
        
        PID:304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A558~1.EXE > nul
        6⤵
        
        PID:1296
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB61D~1.EXE > nul
        5⤵
        
        PID:2092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{57E2A~1.EXE > nul
      4⤵
      PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{53229~1.EXE > nul
    3⤵
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\AFD438~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe

Filesize
372KB

MD5
e37fdc523b6b9de47745f48140cfbadf

SHA1
6ea15a5e6f4258cacf096870f5c4d3c8c9f193a0

SHA256
a81ec499b8f2ded4db01f4c06c374f6527fb6f90d5c0a6e6d91371f4b9a5b40f

SHA512
3208d33dc83473790f5006b3124355c51170fdb583cf6987f0cf3d0f9c87b08607f7061c384aa42b8106a85509441a9c2fa08a04434586f27634fc8d5d51ff2a

Download Submit
C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe

Filesize
372KB

MD5
e37fdc523b6b9de47745f48140cfbadf

SHA1
6ea15a5e6f4258cacf096870f5c4d3c8c9f193a0

SHA256
a81ec499b8f2ded4db01f4c06c374f6527fb6f90d5c0a6e6d91371f4b9a5b40f

SHA512
3208d33dc83473790f5006b3124355c51170fdb583cf6987f0cf3d0f9c87b08607f7061c384aa42b8106a85509441a9c2fa08a04434586f27634fc8d5d51ff2a

Download Submit
C:\Windows\{532299D3-11CA-4d14-B4D2-AB0834A28B96}.exe

Filesize
372KB

MD5
e37fdc523b6b9de47745f48140cfbadf

SHA1
6ea15a5e6f4258cacf096870f5c4d3c8c9f193a0

SHA256
a81ec499b8f2ded4db01f4c06c374f6527fb6f90d5c0a6e6d91371f4b9a5b40f

SHA512
3208d33dc83473790f5006b3124355c51170fdb583cf6987f0cf3d0f9c87b08607f7061c384aa42b8106a85509441a9c2fa08a04434586f27634fc8d5d51ff2a

Download Submit
C:\Windows\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe

Filesize
372KB

MD5
174321eb33dd0f7ca2566ed6d9206c92

SHA1
441c39eb0057042da196f643f611f90b9b7ceb0d

SHA256
7b63f0e822dd048cb9180df64148be95e59fdae237a5966438a65802c7d9f18b

SHA512
33768ea9c22c5791b807dc01ccf36390c47e938de5b2fa6577e034973d2e37f760841a9fce71eb8edd606641ea9e2a2493a60dab440e87ce87a252296aa59077

Download Submit
C:\Windows\{57E2A864-EB20-48cd-BB70-DCE7B0FC1133}.exe

Filesize
372KB

MD5
174321eb33dd0f7ca2566ed6d9206c92

SHA1
441c39eb0057042da196f643f611f90b9b7ceb0d

SHA256
7b63f0e822dd048cb9180df64148be95e59fdae237a5966438a65802c7d9f18b

SHA512
33768ea9c22c5791b807dc01ccf36390c47e938de5b2fa6577e034973d2e37f760841a9fce71eb8edd606641ea9e2a2493a60dab440e87ce87a252296aa59077

Download Submit
C:\Windows\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe

Filesize
372KB

MD5
94674d2206fc0798fe748faa7f5d7c05

SHA1
71bc1c54c088211be3986d5c1046c4500dddb4ec

SHA256
f7753d37f796619ac4b52f7cfb5779a418e19b2ce97a215938c32fcd192a4674

SHA512
b63965eada82c41a47a1506f9e5f4b6470c86374051a5506def62d2956cf53fe41bfe5ca00ded66202158a2b37dc2e343e71de3e3771a44cf1405e207af80b05

Download Submit
C:\Windows\{6DC16F40-59C5-4072-9CF7-9AD5889E616A}.exe

Filesize
372KB

MD5
94674d2206fc0798fe748faa7f5d7c05

SHA1
71bc1c54c088211be3986d5c1046c4500dddb4ec

SHA256
f7753d37f796619ac4b52f7cfb5779a418e19b2ce97a215938c32fcd192a4674

SHA512
b63965eada82c41a47a1506f9e5f4b6470c86374051a5506def62d2956cf53fe41bfe5ca00ded66202158a2b37dc2e343e71de3e3771a44cf1405e207af80b05

Download Submit
C:\Windows\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe

Filesize
372KB

MD5
7d5e9b0dc7e7aeff4a045ba4e257f718

SHA1
d714ed52ff5a79c6ea0d09d26b918cf68843e3d4

SHA256
7b45af63f397a0f88e11522e00c89d2bccd930da2e157b7cf5d8da9ab33a8e97

SHA512
70334b8aa9daed5ad39705ccac519b9a4c294d8d0762d607e7a5348de83e70e576f82968a22d4ab5b0237af95457adba4e4ef87f203450aa67a601d0c0df9c2a

Download Submit
C:\Windows\{745ED4A2-D4E9-4267-BAE9-AF8F23ED41BC}.exe

Filesize
372KB

MD5
7d5e9b0dc7e7aeff4a045ba4e257f718

SHA1
d714ed52ff5a79c6ea0d09d26b918cf68843e3d4

SHA256
7b45af63f397a0f88e11522e00c89d2bccd930da2e157b7cf5d8da9ab33a8e97

SHA512
70334b8aa9daed5ad39705ccac519b9a4c294d8d0762d607e7a5348de83e70e576f82968a22d4ab5b0237af95457adba4e4ef87f203450aa67a601d0c0df9c2a

Download Submit
C:\Windows\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe

Filesize
372KB

MD5
9d0bb564059c5b1bf9b0fa9f3940d0d0

SHA1
ffd99dee854f45e7f84e1e3e883eb79093a76276

SHA256
bd904cf233a1e330c5c41da66658d81bda460377c989c9388098d4ba73faf392

SHA512
918ea4e89e03a960b7fa311a880a5debe65790cae0c2e6210df654f48f744b3d0d59cd3df46898c3e3a7af2509e666cc4787ef972cb043ee83aafd2581f8c44c

Download Submit
C:\Windows\{7A5581E4-DAAC-46ba-9B75-83F6243BA376}.exe

Filesize
372KB

MD5
9d0bb564059c5b1bf9b0fa9f3940d0d0

SHA1
ffd99dee854f45e7f84e1e3e883eb79093a76276

SHA256
bd904cf233a1e330c5c41da66658d81bda460377c989c9388098d4ba73faf392

SHA512
918ea4e89e03a960b7fa311a880a5debe65790cae0c2e6210df654f48f744b3d0d59cd3df46898c3e3a7af2509e666cc4787ef972cb043ee83aafd2581f8c44c

Download Submit
C:\Windows\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe

Filesize
372KB

MD5
4f2d4f2bdd42612f7e0154bc9209bb23

SHA1
23c6b8d41278086c76c9587f56d259a458a8accd

SHA256
9f9377715bf5ec91d2e768ad797b75c788d1862fa6b6b331d02cb507e0d9db9c

SHA512
34385c7d91b6af0755886e37d91b51fbfb1764c9b239f941b8c1139930e9a07f73820478216b4e9285b83907248addd195802e684ae600cc471cff584525c1cf

Download Submit
C:\Windows\{89C869B2-AFED-4268-BF85-15C4680D7432}.exe

Filesize
372KB

MD5
4f2d4f2bdd42612f7e0154bc9209bb23

SHA1
23c6b8d41278086c76c9587f56d259a458a8accd

SHA256
9f9377715bf5ec91d2e768ad797b75c788d1862fa6b6b331d02cb507e0d9db9c

SHA512
34385c7d91b6af0755886e37d91b51fbfb1764c9b239f941b8c1139930e9a07f73820478216b4e9285b83907248addd195802e684ae600cc471cff584525c1cf

Download Submit
C:\Windows\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe

Filesize
372KB

MD5
fc88995284191af60286d38c193809bc

SHA1
ef64bc5c9cbffc3508a98fd3d64c9de5064dbd72

SHA256
c4bf1e91579e507a5506319a31c6d4d8fd135133bee8aaaf2c82a1c76be67018

SHA512
dd9c4d74c9e4cc2264b0225c0f1c5add15d0712fde5298a3c3f2e780902ff196eeb652b35687daafffe394122b9b7c51e8fd4d30efb08c8178e4499dfd669546

Download Submit
C:\Windows\{ADC15CBF-2F5B-44da-BDFA-82350B9847A2}.exe

Filesize
372KB

MD5
fc88995284191af60286d38c193809bc

SHA1
ef64bc5c9cbffc3508a98fd3d64c9de5064dbd72

SHA256
c4bf1e91579e507a5506319a31c6d4d8fd135133bee8aaaf2c82a1c76be67018

SHA512
dd9c4d74c9e4cc2264b0225c0f1c5add15d0712fde5298a3c3f2e780902ff196eeb652b35687daafffe394122b9b7c51e8fd4d30efb08c8178e4499dfd669546

Download Submit
C:\Windows\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe

Filesize
372KB

MD5
54f01da9fb70207dd81b3e0b78c77ffe

SHA1
d629973df668abaf7d9a3b54c291e711ebaf855e

SHA256
7909b67e9014303d213864cc3cc667c098516d19dc4fbb72524cc3101968944f

SHA512
14006376b8917c8ce3f7e7afbe79dd04db26d31869535d149ec7934b65f90d25e23db7245a1d69d1466cabd0b1c3c1229a18373faaa833397f9cf422716aa47c

Download Submit
C:\Windows\{BB61D70B-05FD-4ef9-A4B9-F0415D0D8EA4}.exe

Filesize
372KB

MD5
54f01da9fb70207dd81b3e0b78c77ffe

SHA1
d629973df668abaf7d9a3b54c291e711ebaf855e

SHA256
7909b67e9014303d213864cc3cc667c098516d19dc4fbb72524cc3101968944f

SHA512
14006376b8917c8ce3f7e7afbe79dd04db26d31869535d149ec7934b65f90d25e23db7245a1d69d1466cabd0b1c3c1229a18373faaa833397f9cf422716aa47c

Download Submit
C:\Windows\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe

Filesize
372KB

MD5
4848fff984b9fcba37a59044d4daf757

SHA1
5b76e2dc9de2f45199f7f1edcc7ac5c986733357

SHA256
86e9acecf97ff2cbee1bb8f833772272c1502179d875efc0fac0ef6089879dcf

SHA512
34e7857a93fc664527dd71308f18ec51bd3ab9b4c1f7a8b6225e24401cf93d97ceb9ea872f60eef81441c38ff93f188681f46de27c0457ac4f6216bd9cc9b291

Download Submit
C:\Windows\{DE1D52CC-EC6B-4fcd-AAB9-AFC0FF7973E7}.exe

Filesize
372KB

MD5
4848fff984b9fcba37a59044d4daf757

SHA1
5b76e2dc9de2f45199f7f1edcc7ac5c986733357

SHA256
86e9acecf97ff2cbee1bb8f833772272c1502179d875efc0fac0ef6089879dcf

SHA512
34e7857a93fc664527dd71308f18ec51bd3ab9b4c1f7a8b6225e24401cf93d97ceb9ea872f60eef81441c38ff93f188681f46de27c0457ac4f6216bd9cc9b291

Download Submit
C:\Windows\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe

Filesize
372KB

MD5
601bc645018b5e46de05dcda96a4add3

SHA1
8cbbd7f4167d3c5fd7d246ada3b3ade84c2c97f0

SHA256
d67e5b01d72608ed6d96f1119676dc44db7a0816e745688a349f47b39bfe8626

SHA512
419ca58d3b1543b747c15323810d37656c39ef872271b591c6f5bfbe4d52abbf5ab2e6941fdee7ac675d3024b9a4e867dda2d28d2419ab9c408781bb18bbbe8e

Download Submit
C:\Windows\{E8E024A1-152E-4929-B0D2-9619EF03A086}.exe

Filesize
372KB

MD5
601bc645018b5e46de05dcda96a4add3

SHA1
8cbbd7f4167d3c5fd7d246ada3b3ade84c2c97f0

SHA256
d67e5b01d72608ed6d96f1119676dc44db7a0816e745688a349f47b39bfe8626

SHA512
419ca58d3b1543b747c15323810d37656c39ef872271b591c6f5bfbe4d52abbf5ab2e6941fdee7ac675d3024b9a4e867dda2d28d2419ab9c408781bb18bbbe8e

Download Submit
C:\Windows\{ED31639E-EB37-4ff1-9576-EC7F4635B7CB}.exe

Filesize
372KB

MD5
c659aad6f9e831513057a701cb99f97a

SHA1
3a88ce743903d36a8fa43d3ce65853d51f573f01

SHA256
44e1ddf68bc79e134aab3f4a0a71c4859e8ced06e3d70869d179f1cd0299624c

SHA512
dc9dbe77533b2f48823602377292230ba9311ceb51ae6c6b09b119627a24f63b8e613e6e95e866d8532f49694a7ba2498588a28f18391f8392398b4d3a248e34

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads