d8eec230a8ef23a2c449a2ad61c435df320babf3e31a2061d695e2fc3dd96da6

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-09-2023 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Size

204KB
MD5

1b469edab6a3711c4b683316922b2682
SHA1

89959f6e1db8590257fecf8f01d43f39c52f9ed7
SHA256

d8eec230a8ef23a2c449a2ad61c435df320babf3e31a2061d695e2fc3dd96da6
SHA512

a0261c51dcf60aa98835fde49c673c373c6a03a4587027b90142da3056dd273fb0bb1d8463726c75f6fcd1679f513683c75661af3d78a985c1ebe8370dc5c31f
SSDEEP

1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oWl1OPOe2MUVg3Ve+rXfMUy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}\stubpath = "C:\\Windows\\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe"	{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BB111E-8345-4100-A40F-45E163D8BF8B}\stubpath = "C:\\Windows\\{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe"	{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{181B0E9F-E61B-4106-8D84-0F266379FF24}\stubpath = "C:\\Windows\\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe"	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D90027E4-83B4-4132-9CB5-7A6A053999C1}\stubpath = "C:\\Windows\\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe"	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00E34D6A-E538-4650-8864-F7DE1544821D}	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}\stubpath = "C:\\Windows\\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe"	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52C20936-10BC-4fb8-A290-4FCB013CB180}	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52C20936-10BC-4fb8-A290-4FCB013CB180}\stubpath = "C:\\Windows\\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe"	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}	{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D90027E4-83B4-4132-9CB5-7A6A053999C1}	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}\stubpath = "C:\\Windows\\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe"	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}\stubpath = "C:\\Windows\\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe"	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}\stubpath = "C:\\Windows\\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe"	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BB111E-8345-4100-A40F-45E163D8BF8B}	{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{181B0E9F-E61B-4106-8D84-0F266379FF24}	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}\stubpath = "C:\\Windows\\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe"	{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00E34D6A-E538-4650-8864-F7DE1544821D}\stubpath = "C:\\Windows\\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe"	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}	{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe

Deletes itself 1 IoCs

pid	Process
1868	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
2492	{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
2988	{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
2176	{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
2700	{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
File created	C:\Windows\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe	{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
File created	C:\Windows\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
File created	C:\Windows\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
File created	C:\Windows\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
File created	C:\Windows\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
File created	C:\Windows\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe	{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
File created	C:\Windows\{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe	{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
File created	C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
File created	C:\Windows\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
File created	C:\Windows\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
Token: SeIncBasePriorityPrivilege	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
Token: SeIncBasePriorityPrivilege	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
Token: SeIncBasePriorityPrivilege	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
Token: SeIncBasePriorityPrivilege	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
Token: SeIncBasePriorityPrivilege	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
Token: SeIncBasePriorityPrivilege	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
Token: SeIncBasePriorityPrivilege	2492	{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
Token: SeIncBasePriorityPrivilege	2988	{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
Token: SeIncBasePriorityPrivilege	2176	{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2392	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	28
PID 2472 wrote to memory of 2392	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	28
PID 2472 wrote to memory of 2392	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	28
PID 2472 wrote to memory of 2392	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	28
PID 2472 wrote to memory of 1868	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	29
PID 2472 wrote to memory of 1868	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	29
PID 2472 wrote to memory of 1868	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	29
PID 2472 wrote to memory of 1868	2472	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	29
PID 2392 wrote to memory of 2128	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	30
PID 2392 wrote to memory of 2128	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	30
PID 2392 wrote to memory of 2128	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	30
PID 2392 wrote to memory of 2128	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	30
PID 2392 wrote to memory of 2080	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	31
PID 2392 wrote to memory of 2080	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	31
PID 2392 wrote to memory of 2080	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	31
PID 2392 wrote to memory of 2080	2392	{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe	31
PID 2128 wrote to memory of 2732	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	32
PID 2128 wrote to memory of 2732	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	32
PID 2128 wrote to memory of 2732	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	32
PID 2128 wrote to memory of 2732	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	32
PID 2128 wrote to memory of 2788	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	33
PID 2128 wrote to memory of 2788	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	33
PID 2128 wrote to memory of 2788	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	33
PID 2128 wrote to memory of 2788	2128	{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe	33
PID 2732 wrote to memory of 2548	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	36
PID 2732 wrote to memory of 2548	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	36
PID 2732 wrote to memory of 2548	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	36
PID 2732 wrote to memory of 2548	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	36
PID 2732 wrote to memory of 2720	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	37
PID 2732 wrote to memory of 2720	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	37
PID 2732 wrote to memory of 2720	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	37
PID 2732 wrote to memory of 2720	2732	{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe	37
PID 2548 wrote to memory of 2676	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	38
PID 2548 wrote to memory of 2676	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	38
PID 2548 wrote to memory of 2676	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	38
PID 2548 wrote to memory of 2676	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	38
PID 2548 wrote to memory of 2576	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	39
PID 2548 wrote to memory of 2576	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	39
PID 2548 wrote to memory of 2576	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	39
PID 2548 wrote to memory of 2576	2548	{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe	39
PID 2676 wrote to memory of 2524	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	40
PID 2676 wrote to memory of 2524	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	40
PID 2676 wrote to memory of 2524	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	40
PID 2676 wrote to memory of 2524	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	40
PID 2676 wrote to memory of 2588	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	41
PID 2676 wrote to memory of 2588	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	41
PID 2676 wrote to memory of 2588	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	41
PID 2676 wrote to memory of 2588	2676	{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe	41
PID 2524 wrote to memory of 1208	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	42
PID 2524 wrote to memory of 1208	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	42
PID 2524 wrote to memory of 1208	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	42
PID 2524 wrote to memory of 1208	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	42
PID 2524 wrote to memory of 2272	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	43
PID 2524 wrote to memory of 2272	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	43
PID 2524 wrote to memory of 2272	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	43
PID 2524 wrote to memory of 2272	2524	{00E34D6A-E538-4650-8864-F7DE1544821D}.exe	43
PID 1208 wrote to memory of 2492	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	44
PID 1208 wrote to memory of 2492	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	44
PID 1208 wrote to memory of 2492	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	44
PID 1208 wrote to memory of 2492	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	44
PID 1208 wrote to memory of 2908	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	45
PID 1208 wrote to memory of 2908	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	45
PID 1208 wrote to memory of 2908	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	45
PID 1208 wrote to memory of 2908	1208	{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
  C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
    C:\Windows\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
      C:\Windows\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
        
        C:\Windows\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2548
      - C:\Windows\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
        
        C:\Windows\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
        
        C:\Windows\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
        
        C:\Windows\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
        
        C:\Windows\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
        
        C:\Windows\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F6F9~1.EXE > nul
        11⤵
        
        PID:1672
        
        C:\Windows\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
        
        C:\Windows\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe
        
        C:\Windows\{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe
        12⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DF530~1.EXE > nul
        12⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{52C20~1.EXE > nul
        10⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7913C~1.EXE > nul
        9⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00E34~1.EXE > nul
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C5D9~1.EXE > nul
        7⤵
        
        PID:2588
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8CA98~1.EXE > nul
        6⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FE5E8~1.EXE > nul
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D9002~1.EXE > nul
      4⤵
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{181B0~1.EXE > nul
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe

Filesize
204KB

MD5
4f703b1714908b3de8528596654a86e1

SHA1
111ae204222ec0369f81a25cdc1d55f373d2718c

SHA256
40b49e06d84d8e8b35feea3060345232a412b49e8e689c0c33e3d3c4111b3a9e

SHA512
afecc20b5b2a7df4186a843016d0e33b60b0c95bbf7f1c6178d757ef2885ee816bae9d9f6baa4dcf64eae59461fd1a47011a9379d2a66e32781403293ba1001d

Download Submit
C:\Windows\{00E34D6A-E538-4650-8864-F7DE1544821D}.exe

Filesize
204KB

MD5
4f703b1714908b3de8528596654a86e1

SHA1
111ae204222ec0369f81a25cdc1d55f373d2718c

SHA256
40b49e06d84d8e8b35feea3060345232a412b49e8e689c0c33e3d3c4111b3a9e

SHA512
afecc20b5b2a7df4186a843016d0e33b60b0c95bbf7f1c6178d757ef2885ee816bae9d9f6baa4dcf64eae59461fd1a47011a9379d2a66e32781403293ba1001d

Download Submit
C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe

Filesize
204KB

MD5
a0cb5a0cecbca77ab8d9eed9faddfc18

SHA1
46d44223b27ad99af012de64554e379d7135101a

SHA256
00ba346a698b0637be6373d2f0e6485a280ce515b6ba3a095be71167e0d76c81

SHA512
76194bb0f36d40d9f628d9dbfb6a1bd832dc6c5a01b62888500fc3058fc0c9211570f2e17d5f342a3ae54fef2a0284b839d2c5f17d2d666b37f8129e38e8e3f0

Download Submit
C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe

Filesize
204KB

MD5
a0cb5a0cecbca77ab8d9eed9faddfc18

SHA1
46d44223b27ad99af012de64554e379d7135101a

SHA256
00ba346a698b0637be6373d2f0e6485a280ce515b6ba3a095be71167e0d76c81

SHA512
76194bb0f36d40d9f628d9dbfb6a1bd832dc6c5a01b62888500fc3058fc0c9211570f2e17d5f342a3ae54fef2a0284b839d2c5f17d2d666b37f8129e38e8e3f0

Download Submit
C:\Windows\{181B0E9F-E61B-4106-8D84-0F266379FF24}.exe

Filesize
204KB

MD5
a0cb5a0cecbca77ab8d9eed9faddfc18

SHA1
46d44223b27ad99af012de64554e379d7135101a

SHA256
00ba346a698b0637be6373d2f0e6485a280ce515b6ba3a095be71167e0d76c81

SHA512
76194bb0f36d40d9f628d9dbfb6a1bd832dc6c5a01b62888500fc3058fc0c9211570f2e17d5f342a3ae54fef2a0284b839d2c5f17d2d666b37f8129e38e8e3f0

Download Submit
C:\Windows\{44BB111E-8345-4100-A40F-45E163D8BF8B}.exe

Filesize
204KB

MD5
a904f6ed10f7a16e1b7f010a93411d91

SHA1
04c7ffd12b26caeeab31dcf735caee687a4d2d4d

SHA256
798b8d86eb43efae6190767b9a5c11e9c71664bfc5b199572eaf092db2c1d3fe

SHA512
1d25bad4bf5b710e7c3d15646e02d54361cd297605cab0f138953e804beb4e5dd5beba9bde81c340bbbd9365d079b25d28f77fae48281c6a521fb44f501f4749

Download Submit
C:\Windows\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe

Filesize
204KB

MD5
0770efe5a3e8eca7daa40bc10ff46b4d

SHA1
5aadfbd155b87e5dccded8f127b27502e8cb948d

SHA256
42ee9c1b16d212556c6073bdc12975800d208b86ac50fc50e570df6f40083c85

SHA512
1d71f5ee278a1a08b1d6f616298ce53895e2fd281ebb5861fe68c787779b54fce65308e1c3c7c2fb5fc6c195f2d21d504db2651883cf24c4adcc4165bdbab1fb

Download Submit
C:\Windows\{52C20936-10BC-4fb8-A290-4FCB013CB180}.exe

Filesize
204KB

MD5
0770efe5a3e8eca7daa40bc10ff46b4d

SHA1
5aadfbd155b87e5dccded8f127b27502e8cb948d

SHA256
42ee9c1b16d212556c6073bdc12975800d208b86ac50fc50e570df6f40083c85

SHA512
1d71f5ee278a1a08b1d6f616298ce53895e2fd281ebb5861fe68c787779b54fce65308e1c3c7c2fb5fc6c195f2d21d504db2651883cf24c4adcc4165bdbab1fb

Download Submit
C:\Windows\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe

Filesize
204KB

MD5
74946ffb8c04d122b7c171e5c6cb6353

SHA1
2335a33bf536640554313e51aa7fa0789a5086a6

SHA256
36f099f0a0502bb39e1df5d6f09148ff057e19b28f9aa3111bb32e3920c9eff8

SHA512
12a631c2112ea0da4be5c76dc11eb103fa39b1847746865ffd28c592516440a3a2d9358c492977f375706983a0f705420278c973a1bee1f0584156ba26ceb987

Download Submit
C:\Windows\{6C5D970B-7B72-4233-92AF-E2DCD55236D6}.exe

Filesize
204KB

MD5
74946ffb8c04d122b7c171e5c6cb6353

SHA1
2335a33bf536640554313e51aa7fa0789a5086a6

SHA256
36f099f0a0502bb39e1df5d6f09148ff057e19b28f9aa3111bb32e3920c9eff8

SHA512
12a631c2112ea0da4be5c76dc11eb103fa39b1847746865ffd28c592516440a3a2d9358c492977f375706983a0f705420278c973a1bee1f0584156ba26ceb987

Download Submit
C:\Windows\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe

Filesize
204KB

MD5
d9276e5e39d72601560448d207946035

SHA1
913eaa58448c959e5751e2d49a6c4316e6e77c73

SHA256
289bc392ad510e387c21694d9edaf787f47f065a968081c21d5c5dd8ee263ac6

SHA512
5546aa92051268fe051ce043386ba06e58487d53f0972bf9ada9cfba814cad8ceb1ad93dd45ddaccead537e5f88b99c655d4db1cd0bc7c844fbe1b23bf84f057

Download Submit
C:\Windows\{6F6F9A08-CE2F-491d-9317-C755ED4B1AC6}.exe

Filesize
204KB

MD5
d9276e5e39d72601560448d207946035

SHA1
913eaa58448c959e5751e2d49a6c4316e6e77c73

SHA256
289bc392ad510e387c21694d9edaf787f47f065a968081c21d5c5dd8ee263ac6

SHA512
5546aa92051268fe051ce043386ba06e58487d53f0972bf9ada9cfba814cad8ceb1ad93dd45ddaccead537e5f88b99c655d4db1cd0bc7c844fbe1b23bf84f057

Download Submit
C:\Windows\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe

Filesize
204KB

MD5
17bedda1106a4b53c144c5e0e0503e40

SHA1
6c240a991d56430bde2db7dd70fca75ba66e4eca

SHA256
9a6a21ba6aba918ab4f8888b410023dd51564f9a14e65eaf9951d6dd01fd299d

SHA512
919410c93977022946ff276c3256b8611954113e8b5e31f0656c9867a5c268de121a3c747a9c15e7b4a6f32d42415dfbd7381127b36bd0f571af85ab944554ae

Download Submit
C:\Windows\{7913C054-9BBB-48e1-9B5B-DEEA97B7FFEA}.exe

Filesize
204KB

MD5
17bedda1106a4b53c144c5e0e0503e40

SHA1
6c240a991d56430bde2db7dd70fca75ba66e4eca

SHA256
9a6a21ba6aba918ab4f8888b410023dd51564f9a14e65eaf9951d6dd01fd299d

SHA512
919410c93977022946ff276c3256b8611954113e8b5e31f0656c9867a5c268de121a3c747a9c15e7b4a6f32d42415dfbd7381127b36bd0f571af85ab944554ae

Download Submit
C:\Windows\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe

Filesize
204KB

MD5
4b777f4f9706640ddf37c41bf27f9096

SHA1
9fc6d168b047c405a4877766eb7294433747360c

SHA256
d10e23f782377cba71bb224dadd5dc4cdde9bd87469367e5c4a0b8b057fae8cf

SHA512
860ffc9731f38b89a7a87a7fc1dd9253ccc06b9dc72b21c9cdcec277ecfc7b2ae2d8d2269671d8f25ccc0e5127b883e3f29620a68257362e6b963ebb76202b2d

Download Submit
C:\Windows\{8CA98D66-F34C-442d-90A7-4FB8BDF288F9}.exe

Filesize
204KB

MD5
4b777f4f9706640ddf37c41bf27f9096

SHA1
9fc6d168b047c405a4877766eb7294433747360c

SHA256
d10e23f782377cba71bb224dadd5dc4cdde9bd87469367e5c4a0b8b057fae8cf

SHA512
860ffc9731f38b89a7a87a7fc1dd9253ccc06b9dc72b21c9cdcec277ecfc7b2ae2d8d2269671d8f25ccc0e5127b883e3f29620a68257362e6b963ebb76202b2d

Download Submit
C:\Windows\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe

Filesize
204KB

MD5
194f6d05ddde68531b62363f92a36fef

SHA1
48139e6101da8c1e6c079acc66ea9d6107820c23

SHA256
cb039211e1dc3a9cb3f0a606f9532d72324ebb318b2042bdb4295a51b2f60478

SHA512
bbd8331ad32e711e4dca470c8007363c302dae1efdfff201440bb3a173f1d54b07231041998e439a89892323e3870bef140b167daeb8d110083ed7170d0d01c0

Download Submit
C:\Windows\{D90027E4-83B4-4132-9CB5-7A6A053999C1}.exe

Filesize
204KB

MD5
194f6d05ddde68531b62363f92a36fef

SHA1
48139e6101da8c1e6c079acc66ea9d6107820c23

SHA256
cb039211e1dc3a9cb3f0a606f9532d72324ebb318b2042bdb4295a51b2f60478

SHA512
bbd8331ad32e711e4dca470c8007363c302dae1efdfff201440bb3a173f1d54b07231041998e439a89892323e3870bef140b167daeb8d110083ed7170d0d01c0

Download Submit
C:\Windows\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe

Filesize
204KB

MD5
b494c0f5e9c1ebd55fcf399876e690e3

SHA1
6998bb9ffb7a69c499d0c93a9ca95474ff9747e1

SHA256
5326ea56f0720eb5f30983802d51644db08234a3ffdf30a124eb5eb2573edc05

SHA512
11354794f0bee5df79e2d8f992e533694ed632047f526f8a8732f8ff2f7aec493869c7196fa595c44c61b1b6334d6870e5149adc6390c92458a8fc4ce81f54e1

Download Submit
C:\Windows\{DF5300F9-64BF-4811-AF4A-C69989A3B5E4}.exe

Filesize
204KB

MD5
b494c0f5e9c1ebd55fcf399876e690e3

SHA1
6998bb9ffb7a69c499d0c93a9ca95474ff9747e1

SHA256
5326ea56f0720eb5f30983802d51644db08234a3ffdf30a124eb5eb2573edc05

SHA512
11354794f0bee5df79e2d8f992e533694ed632047f526f8a8732f8ff2f7aec493869c7196fa595c44c61b1b6334d6870e5149adc6390c92458a8fc4ce81f54e1

Download Submit
C:\Windows\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe

Filesize
204KB

MD5
060b19a7cfd4e25a080430920ad892b9

SHA1
2907726b80ccb189283d6697f7de65726e7eef34

SHA256
0bc3fac8749e6ba2d44d1548d1e729a0be30e5f28768c009bdc8015d7d141a34

SHA512
869a1ae20d240f2ba2a5a3cf2a3b6607e02c4972c46180c943fff849d0e1e782d993b455661ad7f632c941ca886bb8ac90286ac7ab407774007541013e3f6da9

Download Submit
C:\Windows\{FE5E8EFE-1895-4826-B5AE-857F3DCE7E1A}.exe

Filesize
204KB

MD5
060b19a7cfd4e25a080430920ad892b9

SHA1
2907726b80ccb189283d6697f7de65726e7eef34

SHA256
0bc3fac8749e6ba2d44d1548d1e729a0be30e5f28768c009bdc8015d7d141a34

SHA512
869a1ae20d240f2ba2a5a3cf2a3b6607e02c4972c46180c943fff849d0e1e782d993b455661ad7f632c941ca886bb8ac90286ac7ab407774007541013e3f6da9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads