d8eec230a8ef23a2c449a2ad61c435df320babf3e31a2061d695e2fc3dd96da6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2023 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Size

204KB
MD5

1b469edab6a3711c4b683316922b2682
SHA1

89959f6e1db8590257fecf8f01d43f39c52f9ed7
SHA256

d8eec230a8ef23a2c449a2ad61c435df320babf3e31a2061d695e2fc3dd96da6
SHA512

a0261c51dcf60aa98835fde49c673c373c6a03a4587027b90142da3056dd273fb0bb1d8463726c75f6fcd1679f513683c75661af3d78a985c1ebe8370dc5c31f
SSDEEP

1536:1EGh0oWl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oWl1OPOe2MUVg3Ve+rXfMUy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}	{2151D760-F618-4087-B8F2-8324968525E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}\stubpath = "C:\\Windows\\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe"	{2151D760-F618-4087-B8F2-8324968525E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}\stubpath = "C:\\Windows\\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe"	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}\stubpath = "C:\\Windows\\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe"	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2151D760-F618-4087-B8F2-8324968525E4}	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{333E55F5-FD21-42dd-AC42-54821ABDDA60}	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03226E57-779E-4ef0-92A2-60F8D182D504}	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97D144EB-DA16-495e-B78F-1C55A1F0B686}	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}	{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}\stubpath = "C:\\Windows\\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe"	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}\stubpath = "C:\\Windows\\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe"	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{333E55F5-FD21-42dd-AC42-54821ABDDA60}\stubpath = "C:\\Windows\\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe"	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03226E57-779E-4ef0-92A2-60F8D182D504}\stubpath = "C:\\Windows\\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe"	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97D144EB-DA16-495e-B78F-1C55A1F0B686}\stubpath = "C:\\Windows\\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe"	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411FB178-D843-4305-BAF0-4D77078DE0A3}	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411FB178-D843-4305-BAF0-4D77078DE0A3}\stubpath = "C:\\Windows\\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe"	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}\stubpath = "C:\\Windows\\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe"	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2151D760-F618-4087-B8F2-8324968525E4}\stubpath = "C:\\Windows\\{2151D760-F618-4087-B8F2-8324968525E4}.exe"	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}\stubpath = "C:\\Windows\\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe"	{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe

Executes dropped EXE 12 IoCs

pid	Process
2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe
3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
3572	{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe
1564	{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{2151D760-F618-4087-B8F2-8324968525E4}.exe	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
File created	C:\Windows\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
File created	C:\Windows\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
File created	C:\Windows\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
File created	C:\Windows\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
File created	C:\Windows\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
File created	C:\Windows\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
File created	C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	{2151D760-F618-4087-B8F2-8324968525E4}.exe
File created	C:\Windows\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
File created	C:\Windows\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
File created	C:\Windows\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
File created	C:\Windows\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe	{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
Token: SeIncBasePriorityPrivilege	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe
Token: SeIncBasePriorityPrivilege	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
Token: SeIncBasePriorityPrivilege	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
Token: SeIncBasePriorityPrivilege	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
Token: SeIncBasePriorityPrivilege	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
Token: SeIncBasePriorityPrivilege	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
Token: SeIncBasePriorityPrivilege	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
Token: SeIncBasePriorityPrivilege	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
Token: SeIncBasePriorityPrivilege	2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
Token: SeIncBasePriorityPrivilege	3572	{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2752	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	87
PID 5064 wrote to memory of 2752	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	87
PID 5064 wrote to memory of 2752	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	87
PID 5064 wrote to memory of 100	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	88
PID 5064 wrote to memory of 100	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	88
PID 5064 wrote to memory of 100	5064	2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe	88
PID 2752 wrote to memory of 1460	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	89
PID 2752 wrote to memory of 1460	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	89
PID 2752 wrote to memory of 1460	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	89
PID 2752 wrote to memory of 2416	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	90
PID 2752 wrote to memory of 2416	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	90
PID 2752 wrote to memory of 2416	2752	{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe	90
PID 1460 wrote to memory of 3120	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	95
PID 1460 wrote to memory of 3120	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	95
PID 1460 wrote to memory of 3120	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	95
PID 1460 wrote to memory of 1776	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	94
PID 1460 wrote to memory of 1776	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	94
PID 1460 wrote to memory of 1776	1460	{2151D760-F618-4087-B8F2-8324968525E4}.exe	94
PID 3120 wrote to memory of 2992	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	96
PID 3120 wrote to memory of 2992	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	96
PID 3120 wrote to memory of 2992	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	96
PID 3120 wrote to memory of 2332	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	97
PID 3120 wrote to memory of 2332	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	97
PID 3120 wrote to memory of 2332	3120	{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe	97
PID 2992 wrote to memory of 1744	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	98
PID 2992 wrote to memory of 1744	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	98
PID 2992 wrote to memory of 1744	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	98
PID 2992 wrote to memory of 3952	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	99
PID 2992 wrote to memory of 3952	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	99
PID 2992 wrote to memory of 3952	2992	{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe	99
PID 1744 wrote to memory of 2376	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	100
PID 1744 wrote to memory of 2376	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	100
PID 1744 wrote to memory of 2376	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	100
PID 1744 wrote to memory of 4636	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	101
PID 1744 wrote to memory of 4636	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	101
PID 1744 wrote to memory of 4636	1744	{03226E57-779E-4ef0-92A2-60F8D182D504}.exe	101
PID 2376 wrote to memory of 4236	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	102
PID 2376 wrote to memory of 4236	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	102
PID 2376 wrote to memory of 4236	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	102
PID 2376 wrote to memory of 2672	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	103
PID 2376 wrote to memory of 2672	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	103
PID 2376 wrote to memory of 2672	2376	{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe	103
PID 4236 wrote to memory of 4352	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	104
PID 4236 wrote to memory of 4352	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	104
PID 4236 wrote to memory of 4352	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	104
PID 4236 wrote to memory of 3436	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	105
PID 4236 wrote to memory of 3436	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	105
PID 4236 wrote to memory of 3436	4236	{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe	105
PID 4352 wrote to memory of 3996	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	106
PID 4352 wrote to memory of 3996	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	106
PID 4352 wrote to memory of 3996	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	106
PID 4352 wrote to memory of 3840	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	107
PID 4352 wrote to memory of 3840	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	107
PID 4352 wrote to memory of 3840	4352	{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe	107
PID 3996 wrote to memory of 2588	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	108
PID 3996 wrote to memory of 2588	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	108
PID 3996 wrote to memory of 2588	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	108
PID 3996 wrote to memory of 4268	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	109
PID 3996 wrote to memory of 4268	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	109
PID 3996 wrote to memory of 4268	3996	{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe	109
PID 2588 wrote to memory of 3572	2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe	110
PID 2588 wrote to memory of 3572	2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe	110
PID 2588 wrote to memory of 3572	2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe	110
PID 2588 wrote to memory of 1288	2588	{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe	111

C:\Users\Admin\AppData\Local\Temp\2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_1b469edab6a3711c4b683316922b2682_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
  C:\Windows\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\{2151D760-F618-4087-B8F2-8324968525E4}.exe
    C:\Windows\{2151D760-F618-4087-B8F2-8324968525E4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2151D~1.EXE > nul
      4⤵
      PID:1776
  - - C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
      C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
        
        C:\Windows\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Windows\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
        
        C:\Windows\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
        
        C:\Windows\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
        
        C:\Windows\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
        
        C:\Windows\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
        
        C:\Windows\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
        
        C:\Windows\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe
        
        C:\Windows\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Windows\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe
        
        C:\Windows\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe
        13⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A0A6~1.EXE > nul
        13⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE389~1.EXE > nul
        12⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB7D4~1.EXE > nul
        11⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FAFF~1.EXE > nul
        10⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{411FB~1.EXE > nul
        9⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97D14~1.EXE > nul
        8⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{03226~1.EXE > nul
        7⤵
        
        PID:4636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{333E5~1.EXE > nul
        6⤵
        
        PID:3952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CAD57~1.EXE > nul
        5⤵
        
        PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2D311~1.EXE > nul
    3⤵
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  PID:100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe

Filesize
204KB

MD5
73d320ef743f85ff197bf255255307bd

SHA1
84d3143b461b752b1521d0c3a9b4c938775e2163

SHA256
34c8a6feacc963426b3bf18c1b2e76e4a3ede2807487a2430e288f90c6fa7dad

SHA512
814426897f21fc532db459d18dda751273433601ccaa028d46770ecf882c4a8851d69b190066a10b2bee48df5443bcbb598babdb10c65010c9e918a96cf10e3a

Download Submit
C:\Windows\{03226E57-779E-4ef0-92A2-60F8D182D504}.exe

Filesize
204KB

MD5
73d320ef743f85ff197bf255255307bd

SHA1
84d3143b461b752b1521d0c3a9b4c938775e2163

SHA256
34c8a6feacc963426b3bf18c1b2e76e4a3ede2807487a2430e288f90c6fa7dad

SHA512
814426897f21fc532db459d18dda751273433601ccaa028d46770ecf882c4a8851d69b190066a10b2bee48df5443bcbb598babdb10c65010c9e918a96cf10e3a

Download Submit
C:\Windows\{2151D760-F618-4087-B8F2-8324968525E4}.exe

Filesize
204KB

MD5
a52618ca25d7e0b264b4624bd5d8876f

SHA1
2337f41a99b9b9a6d53137c35ce8a621ea8968f1

SHA256
285813e4eee771274c6aeebc94e2c235bd1f352a331ab8e7d0c48221599b7ccb

SHA512
b883948fec3a51241ed6a5b6e039817ef590a1ec7b7791c7be34d39a1a6ffaed8a16a2222653fe2859f08e767fed71e647fc5fb86ce79cb0a8c07ae2e1286696

Download Submit
C:\Windows\{2151D760-F618-4087-B8F2-8324968525E4}.exe

Filesize
204KB

MD5
a52618ca25d7e0b264b4624bd5d8876f

SHA1
2337f41a99b9b9a6d53137c35ce8a621ea8968f1

SHA256
285813e4eee771274c6aeebc94e2c235bd1f352a331ab8e7d0c48221599b7ccb

SHA512
b883948fec3a51241ed6a5b6e039817ef590a1ec7b7791c7be34d39a1a6ffaed8a16a2222653fe2859f08e767fed71e647fc5fb86ce79cb0a8c07ae2e1286696

Download Submit
C:\Windows\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe

Filesize
204KB

MD5
399a223eb50384edaf12a635c374e086

SHA1
1b7142a84562097c609b5a591749cadf6bb3ae84

SHA256
357c65337e3aec490f060ef94b2f9765d16a2132acffd16dee3ae9b385ad3ac3

SHA512
228b61c84f1a97ac2c87ed1c404374377d0623802e32cdfb25af3e63f8f031bf93e2a898142e0476b41100b1005a2f8747e8363bf139ae17b8ae94eb95832bb4

Download Submit
C:\Windows\{2D3119DD-D9A1-4bd4-B0E5-E5AE4C33B808}.exe

Filesize
204KB

MD5
399a223eb50384edaf12a635c374e086

SHA1
1b7142a84562097c609b5a591749cadf6bb3ae84

SHA256
357c65337e3aec490f060ef94b2f9765d16a2132acffd16dee3ae9b385ad3ac3

SHA512
228b61c84f1a97ac2c87ed1c404374377d0623802e32cdfb25af3e63f8f031bf93e2a898142e0476b41100b1005a2f8747e8363bf139ae17b8ae94eb95832bb4

Download Submit
C:\Windows\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe

Filesize
204KB

MD5
7e2d7842953d7f9bb250185344b262be

SHA1
46fbd335383d0dd9845cc33f9a9ee59beb311f6f

SHA256
f50d028e48e73628d0a9beb7f876b65fe64b5f3a677c9d3955d6033d2c42792e

SHA512
9d5b40e21274e4f70272aa88b88f914a07a6c4c0e4c23d5f8d2878dc0ca9ba9eff8d03f0e9743659b1501094da4231e9d5bec946931090562789046e2920f958

Download Submit
C:\Windows\{333E55F5-FD21-42dd-AC42-54821ABDDA60}.exe

Filesize
204KB

MD5
7e2d7842953d7f9bb250185344b262be

SHA1
46fbd335383d0dd9845cc33f9a9ee59beb311f6f

SHA256
f50d028e48e73628d0a9beb7f876b65fe64b5f3a677c9d3955d6033d2c42792e

SHA512
9d5b40e21274e4f70272aa88b88f914a07a6c4c0e4c23d5f8d2878dc0ca9ba9eff8d03f0e9743659b1501094da4231e9d5bec946931090562789046e2920f958

Download Submit
C:\Windows\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe

Filesize
204KB

MD5
b91faf5c4e1be24d0bd11e36c12f914a

SHA1
534a7e332865ae2db2667ed085aa5452e9e10429

SHA256
a4a36d395194bb070465cb7b921758a9b847ba5d6ad980ec42ad5501035041b3

SHA512
5cae763e5e3d417f10788942a86f397b581d5ab9756c1e5013589c3b206434b114c713446881a7d4d3f4f249304f4982b91622f566d40de9f49415946b616316

Download Submit
C:\Windows\{411FB178-D843-4305-BAF0-4D77078DE0A3}.exe

Filesize
204KB

MD5
b91faf5c4e1be24d0bd11e36c12f914a

SHA1
534a7e332865ae2db2667ed085aa5452e9e10429

SHA256
a4a36d395194bb070465cb7b921758a9b847ba5d6ad980ec42ad5501035041b3

SHA512
5cae763e5e3d417f10788942a86f397b581d5ab9756c1e5013589c3b206434b114c713446881a7d4d3f4f249304f4982b91622f566d40de9f49415946b616316

Download Submit
C:\Windows\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe

Filesize
204KB

MD5
a26fc895685ca60e2c054d5eb46577ef

SHA1
d2ff28924a7c76fb45dd6b0345320dd3d8d64842

SHA256
0c4def9d8a0a1fa73c29f71a648596ee9e19f09c2c2ed19d5957b4f4c15c3c3f

SHA512
4b4dcb2c63cda9a2c44bf1bcdf153073c7d4554d58141b28c4c11af2b1dc30f41bc8ccc21c80b8ef44ad4444a9fe13127886d08e63e70b1ce12737b8c5a3d9ff

Download Submit
C:\Windows\{4FAFFF5C-2869-4144-BFBA-49C80400F43A}.exe

Filesize
204KB

MD5
a26fc895685ca60e2c054d5eb46577ef

SHA1
d2ff28924a7c76fb45dd6b0345320dd3d8d64842

SHA256
0c4def9d8a0a1fa73c29f71a648596ee9e19f09c2c2ed19d5957b4f4c15c3c3f

SHA512
4b4dcb2c63cda9a2c44bf1bcdf153073c7d4554d58141b28c4c11af2b1dc30f41bc8ccc21c80b8ef44ad4444a9fe13127886d08e63e70b1ce12737b8c5a3d9ff

Download Submit
C:\Windows\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe

Filesize
204KB

MD5
2712b7bdc71d34329bb89429f5feecf6

SHA1
20267115ad8f364a11632a361d0d7b97b8faae88

SHA256
327cc94934906ba936ac3c752b14101a2b30363e851acdfce4b00b9983d624e5

SHA512
dec6e36d3bd6794ee169f3f4697655b8885339e4841e0f0780b288b9f0f2d8f6aa7be36c1ea811bf9b5fcca1654c27279cb37a5cf3bde70f1b5525519276cccc

Download Submit
C:\Windows\{8A0A61CE-6777-41f8-B1CF-05659C5C333B}.exe

Filesize
204KB

MD5
2712b7bdc71d34329bb89429f5feecf6

SHA1
20267115ad8f364a11632a361d0d7b97b8faae88

SHA256
327cc94934906ba936ac3c752b14101a2b30363e851acdfce4b00b9983d624e5

SHA512
dec6e36d3bd6794ee169f3f4697655b8885339e4841e0f0780b288b9f0f2d8f6aa7be36c1ea811bf9b5fcca1654c27279cb37a5cf3bde70f1b5525519276cccc

Download Submit
C:\Windows\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe

Filesize
204KB

MD5
096be05fb4ac0c4b340432dc9f66cab4

SHA1
428c48472c4de056899be106e71288186408cd22

SHA256
2d12cc325edc4e852e43c6322d4f695a56098d58d90a2b05293fa9f5a009d10c

SHA512
ea49dd9004d60de491a0e6a566bc08c40c2d9ac109704f8f9dc0edcaf39cf3f421bd43e90b69ef4ba4728dd6155a2ef6216c8ec8e1f8cf36895cc9b31fe39b3c

Download Submit
C:\Windows\{97D144EB-DA16-495e-B78F-1C55A1F0B686}.exe

Filesize
204KB

MD5
096be05fb4ac0c4b340432dc9f66cab4

SHA1
428c48472c4de056899be106e71288186408cd22

SHA256
2d12cc325edc4e852e43c6322d4f695a56098d58d90a2b05293fa9f5a009d10c

SHA512
ea49dd9004d60de491a0e6a566bc08c40c2d9ac109704f8f9dc0edcaf39cf3f421bd43e90b69ef4ba4728dd6155a2ef6216c8ec8e1f8cf36895cc9b31fe39b3c

Download Submit
C:\Windows\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe

Filesize
204KB

MD5
a26ec5e36a4cb65583754af7cc042f50

SHA1
a4cae1aff27cf33f0747eba6b06e44fcafc0a242

SHA256
f7a6370876f07e3590e3792f2d40220c6ce9e35921c77ebdbedb1f8fc7257b79

SHA512
b5340eae62e9fdde9a6c3c1197b61f0e497ca341b1aa9ef76b2c114a68923c28bce0249a0094ad340f616cb813a67ebac182475c1f2b9a36396f9eb11326a20a

Download Submit
C:\Windows\{B7A263E0-8D2B-473b-AC55-F532EE407C9B}.exe

Filesize
204KB

MD5
a26ec5e36a4cb65583754af7cc042f50

SHA1
a4cae1aff27cf33f0747eba6b06e44fcafc0a242

SHA256
f7a6370876f07e3590e3792f2d40220c6ce9e35921c77ebdbedb1f8fc7257b79

SHA512
b5340eae62e9fdde9a6c3c1197b61f0e497ca341b1aa9ef76b2c114a68923c28bce0249a0094ad340f616cb813a67ebac182475c1f2b9a36396f9eb11326a20a

Download Submit
C:\Windows\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe

Filesize
204KB

MD5
8d06756fea7df8f75938f3023ecc68d0

SHA1
f7b65ce6630316d1b54bcf2cc9a1c68ed975c344

SHA256
e885f45788d7e72fae1495f72d007de5bf97e6f8872769992a8b7139ddb3c58b

SHA512
e8528c01a3c208c2d87b3bd411c87042b68d4929e736f15511c726d9a177896cebacf890f2c57f66b8fac72ea2786330c4b79e874dbdeb8c882051f93ffc9754

Download Submit
C:\Windows\{BB7D4481-D35F-4e4c-9B1F-7CCE41DC5898}.exe

Filesize
204KB

MD5
8d06756fea7df8f75938f3023ecc68d0

SHA1
f7b65ce6630316d1b54bcf2cc9a1c68ed975c344

SHA256
e885f45788d7e72fae1495f72d007de5bf97e6f8872769992a8b7139ddb3c58b

SHA512
e8528c01a3c208c2d87b3bd411c87042b68d4929e736f15511c726d9a177896cebacf890f2c57f66b8fac72ea2786330c4b79e874dbdeb8c882051f93ffc9754

Download Submit
C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe

Filesize
204KB

MD5
d55933037247e17d4f655926655b89d7

SHA1
00ce9935882b547ea08eff4cb3cf2183e83b78d5

SHA256
5adc6cd86f2eecad14a5f69fc2e9eeabd840ef3b0161c9ed53289fa3a292d784

SHA512
a868fe1ccb613f725b13368074b877cfba8a82e6398fd444bd596d579c2d45542a746ab8e50678fa7079b77845db189246ff80b744c521611365e7c57fb30e1c

Download Submit
C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe

Filesize
204KB

MD5
d55933037247e17d4f655926655b89d7

SHA1
00ce9935882b547ea08eff4cb3cf2183e83b78d5

SHA256
5adc6cd86f2eecad14a5f69fc2e9eeabd840ef3b0161c9ed53289fa3a292d784

SHA512
a868fe1ccb613f725b13368074b877cfba8a82e6398fd444bd596d579c2d45542a746ab8e50678fa7079b77845db189246ff80b744c521611365e7c57fb30e1c

Download Submit
C:\Windows\{CAD57F42-585D-415a-AB68-ACEE5A0C80FF}.exe

Filesize
204KB

MD5
d55933037247e17d4f655926655b89d7

SHA1
00ce9935882b547ea08eff4cb3cf2183e83b78d5

SHA256
5adc6cd86f2eecad14a5f69fc2e9eeabd840ef3b0161c9ed53289fa3a292d784

SHA512
a868fe1ccb613f725b13368074b877cfba8a82e6398fd444bd596d579c2d45542a746ab8e50678fa7079b77845db189246ff80b744c521611365e7c57fb30e1c

Download Submit
C:\Windows\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe

Filesize
204KB

MD5
9d9cdba40ae423d8d645dfccf4de5fb1

SHA1
bd7b5ad8b865f38f8ee8ef86b3fcabfeb9cafa8d

SHA256
38b060aa0501745894a1c777ac372c11b5fb1666cdb97dc91aa4173666dc66d2

SHA512
f3d591dd9e5b78468a97addf164321b9156cf2efd93333007c21b1b717058bc8a3ec0849f291ebc1e0b492f1b294fc4ffe61011097b1684c27613254e93476a1

Download Submit
C:\Windows\{CE389C7A-9C2F-4042-BBB4-78702365BA0C}.exe

Filesize
204KB

MD5
9d9cdba40ae423d8d645dfccf4de5fb1

SHA1
bd7b5ad8b865f38f8ee8ef86b3fcabfeb9cafa8d

SHA256
38b060aa0501745894a1c777ac372c11b5fb1666cdb97dc91aa4173666dc66d2

SHA512
f3d591dd9e5b78468a97addf164321b9156cf2efd93333007c21b1b717058bc8a3ec0849f291ebc1e0b492f1b294fc4ffe61011097b1684c27613254e93476a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads