0f1cc9bd72042d38c102b578c7a0ea72dc56d4d2875ffa92fbf6d6a38e277f19

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
Size

192KB
MD5

b71e9bab5f161aa5a8ef396590c5c888
SHA1

54fb4fd90e9b16d518e1313f1291d6c10575cbc0
SHA256

0f1cc9bd72042d38c102b578c7a0ea72dc56d4d2875ffa92fbf6d6a38e277f19
SHA512

7fdbcb70ab892f9d6434e371fbc83a0989f8ecba87f2ec984f9f720fecf877fdd0ecbd3b96ea2f3c014d891b11e2cf349b8cc0c8478dc47d5d4e7115a3e5b67d
SSDEEP

1536:1EGh0oTLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oXl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC13297F-4146-4617-AE58-2A4294C86D68}	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}\stubpath = "C:\\Windows\\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe"	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}	{A8890301-1251-4c60-9A96-AA85640BF882}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC13297F-4146-4617-AE58-2A4294C86D68}\stubpath = "C:\\Windows\\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe"	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08F4672E-1995-42cc-8EB4-64A4046F8B17}\stubpath = "C:\\Windows\\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe"	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}\stubpath = "C:\\Windows\\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe"	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8890301-1251-4c60-9A96-AA85640BF882}	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D2B8D15-D588-4911-BA7F-5903A0644C00}	{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D2B8D15-D588-4911-BA7F-5903A0644C00}\stubpath = "C:\\Windows\\{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe"	{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}\stubpath = "C:\\Windows\\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe"	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}\stubpath = "C:\\Windows\\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe"	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30DD2F4E-4469-45d6-A404-D75D342F5104}	{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30DD2F4E-4469-45d6-A404-D75D342F5104}\stubpath = "C:\\Windows\\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe"	{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}\stubpath = "C:\\Windows\\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe"	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08F4672E-1995-42cc-8EB4-64A4046F8B17}	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8890301-1251-4c60-9A96-AA85640BF882}\stubpath = "C:\\Windows\\{A8890301-1251-4c60-9A96-AA85640BF882}.exe"	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}\stubpath = "C:\\Windows\\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe"	{A8890301-1251-4c60-9A96-AA85640BF882}.exe

Deletes itself 1 IoCs

pid	Process
2552	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
1096	{A8890301-1251-4c60-9A96-AA85640BF882}.exe
2744	{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
2112	{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
1788	{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A8890301-1251-4c60-9A96-AA85640BF882}.exe	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
File created	C:\Windows\{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe	{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
File created	C:\Windows\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
File created	C:\Windows\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
File created	C:\Windows\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
File created	C:\Windows\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
File created	C:\Windows\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe	{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
File created	C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
File created	C:\Windows\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
File created	C:\Windows\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
File created	C:\Windows\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe	{A8890301-1251-4c60-9A96-AA85640BF882}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
Token: SeIncBasePriorityPrivilege	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
Token: SeIncBasePriorityPrivilege	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
Token: SeIncBasePriorityPrivilege	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
Token: SeIncBasePriorityPrivilege	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
Token: SeIncBasePriorityPrivilege	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
Token: SeIncBasePriorityPrivilege	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
Token: SeIncBasePriorityPrivilege	1096	{A8890301-1251-4c60-9A96-AA85640BF882}.exe
Token: SeIncBasePriorityPrivilege	2744	{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
Token: SeIncBasePriorityPrivilege	2112	{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2532	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	28
PID 2776 wrote to memory of 2532	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	28
PID 2776 wrote to memory of 2532	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	28
PID 2776 wrote to memory of 2532	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	28
PID 2776 wrote to memory of 2552	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	29
PID 2776 wrote to memory of 2552	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	29
PID 2776 wrote to memory of 2552	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	29
PID 2776 wrote to memory of 2552	2776	2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe	29
PID 2532 wrote to memory of 2708	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	30
PID 2532 wrote to memory of 2708	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	30
PID 2532 wrote to memory of 2708	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	30
PID 2532 wrote to memory of 2708	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	30
PID 2532 wrote to memory of 2584	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	31
PID 2532 wrote to memory of 2584	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	31
PID 2532 wrote to memory of 2584	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	31
PID 2532 wrote to memory of 2584	2532	{FC13297F-4146-4617-AE58-2A4294C86D68}.exe	31
PID 2708 wrote to memory of 2544	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	34
PID 2708 wrote to memory of 2544	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	34
PID 2708 wrote to memory of 2544	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	34
PID 2708 wrote to memory of 2544	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	34
PID 2708 wrote to memory of 2580	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	35
PID 2708 wrote to memory of 2580	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	35
PID 2708 wrote to memory of 2580	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	35
PID 2708 wrote to memory of 2580	2708	{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe	35
PID 2544 wrote to memory of 1764	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	36
PID 2544 wrote to memory of 1764	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	36
PID 2544 wrote to memory of 1764	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	36
PID 2544 wrote to memory of 1764	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	36
PID 2544 wrote to memory of 2460	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	37
PID 2544 wrote to memory of 2460	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	37
PID 2544 wrote to memory of 2460	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	37
PID 2544 wrote to memory of 2460	2544	{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe	37
PID 1764 wrote to memory of 2564	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	38
PID 1764 wrote to memory of 2564	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	38
PID 1764 wrote to memory of 2564	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	38
PID 1764 wrote to memory of 2564	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	38
PID 1764 wrote to memory of 2952	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	39
PID 1764 wrote to memory of 2952	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	39
PID 1764 wrote to memory of 2952	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	39
PID 1764 wrote to memory of 2952	1764	{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe	39
PID 2564 wrote to memory of 2880	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	40
PID 2564 wrote to memory of 2880	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	40
PID 2564 wrote to memory of 2880	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	40
PID 2564 wrote to memory of 2880	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	40
PID 2564 wrote to memory of 476	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	41
PID 2564 wrote to memory of 476	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	41
PID 2564 wrote to memory of 476	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	41
PID 2564 wrote to memory of 476	2564	{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe	41
PID 2880 wrote to memory of 1664	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	42
PID 2880 wrote to memory of 1664	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	42
PID 2880 wrote to memory of 1664	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	42
PID 2880 wrote to memory of 1664	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	42
PID 2880 wrote to memory of 112	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	43
PID 2880 wrote to memory of 112	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	43
PID 2880 wrote to memory of 112	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	43
PID 2880 wrote to memory of 112	2880	{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe	43
PID 1664 wrote to memory of 1096	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	44
PID 1664 wrote to memory of 1096	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	44
PID 1664 wrote to memory of 1096	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	44
PID 1664 wrote to memory of 1096	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	44
PID 1664 wrote to memory of 620	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	45
PID 1664 wrote to memory of 620	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	45
PID 1664 wrote to memory of 620	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	45
PID 1664 wrote to memory of 620	1664	{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe	45

C:\Users\Admin\AppData\Local\Temp\2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_b71e9bab5f161aa5a8ef396590c5c888_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
  C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
    C:\Windows\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
      C:\Windows\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Windows\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
        
        C:\Windows\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
        
        C:\Windows\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
        
        C:\Windows\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
        
        C:\Windows\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\{A8890301-1251-4c60-9A96-AA85640BF882}.exe
        
        C:\Windows\{A8890301-1251-4c60-9A96-AA85640BF882}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Windows\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
        
        C:\Windows\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Windows\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
        
        C:\Windows\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe
        
        C:\Windows\{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe
        12⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30DD2~1.EXE > nul
        12⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D6E9~1.EXE > nul
        11⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8890~1.EXE > nul
        10⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5E401~1.EXE > nul
        9⤵
        
        PID:620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D407~1.EXE > nul
        8⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{08F46~1.EXE > nul
        7⤵
        
        PID:476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{90441~1.EXE > nul
        6⤵
        
        PID:2952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9AB73~1.EXE > nul
        5⤵
        
        PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A0DD2~1.EXE > nul
      4⤵
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FC132~1.EXE > nul
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe

Filesize
192KB

MD5
f5b01163985f01463445e4dd628916dd

SHA1
52d13fc5a00e05bebe9c547804fcbd6579cbd35b

SHA256
4340302697d6bb800fb24c5f97f3621bd233240e327f1fb980cc90b69ed45724

SHA512
6f099bf3c4b7a99cc57880e76089bef9ac193cae03e265469fce1ea0365cbc8509004ce9e60ce845c6ac32422a543f5ee704b94dcbc0c22fa16fb64807b9a074

Download Submit
C:\Windows\{08F4672E-1995-42cc-8EB4-64A4046F8B17}.exe

Filesize
192KB

MD5
f5b01163985f01463445e4dd628916dd

SHA1
52d13fc5a00e05bebe9c547804fcbd6579cbd35b

SHA256
4340302697d6bb800fb24c5f97f3621bd233240e327f1fb980cc90b69ed45724

SHA512
6f099bf3c4b7a99cc57880e76089bef9ac193cae03e265469fce1ea0365cbc8509004ce9e60ce845c6ac32422a543f5ee704b94dcbc0c22fa16fb64807b9a074

Download Submit
C:\Windows\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe

Filesize
192KB

MD5
1a6192372b22c0c342b0e37a6d1e567b

SHA1
66bc7792976492a77447c17dc707e3b044392dd0

SHA256
a521fb1f1f847cabbb925e3832c8fd0ee33568ea376194bddb6d41c004c37ec3

SHA512
7fd8ce9ef987f338cba37032a80c00abb0f213c930f241ee80233857068202b56c85f1e74e55f475df0b9ac159ead92697b57c21a530562159ce6803ffb441b1

Download Submit
C:\Windows\{30DD2F4E-4469-45d6-A404-D75D342F5104}.exe

Filesize
192KB

MD5
1a6192372b22c0c342b0e37a6d1e567b

SHA1
66bc7792976492a77447c17dc707e3b044392dd0

SHA256
a521fb1f1f847cabbb925e3832c8fd0ee33568ea376194bddb6d41c004c37ec3

SHA512
7fd8ce9ef987f338cba37032a80c00abb0f213c930f241ee80233857068202b56c85f1e74e55f475df0b9ac159ead92697b57c21a530562159ce6803ffb441b1

Download Submit
C:\Windows\{3D2B8D15-D588-4911-BA7F-5903A0644C00}.exe

Filesize
192KB

MD5
333df5edbc7eb4668f32a9edbd8b8f9c

SHA1
4bf20e272f4cac59b47fbcfafa8fbe5bc0a3847e

SHA256
47e688bcd0371b83e86a4c8b419f99523b4b10d10bef8589b3d7501ff4df3d56

SHA512
e0fef731742ae25b299f4aabf721409fe75044396aed788dd3652cb56676d050bea77d143215a599d4535fbc457e85552b06bc7236f37ecb7db3efc433a5fdfe

Download Submit
C:\Windows\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe

Filesize
192KB

MD5
cccb71321f12fe1013c41d3fa8bc9eed

SHA1
ef4776657b38f34fb552805779588a2065f11cc1

SHA256
b8bd9c352724f4b06559fa8c84ba276c1ae3c06e28f237a905ff74576c7836ba

SHA512
4912c577801432fcaf144ff3437b9378d23ab48b91c85dba9a4300dc65fa2c8da00be38ea7ab3c9bc136def0712717ac040ab549f5539ccbd3dfaf9e17040281

Download Submit
C:\Windows\{3D407D58-C829-4f6e-8C5C-1277C35C5B8F}.exe

Filesize
192KB

MD5
cccb71321f12fe1013c41d3fa8bc9eed

SHA1
ef4776657b38f34fb552805779588a2065f11cc1

SHA256
b8bd9c352724f4b06559fa8c84ba276c1ae3c06e28f237a905ff74576c7836ba

SHA512
4912c577801432fcaf144ff3437b9378d23ab48b91c85dba9a4300dc65fa2c8da00be38ea7ab3c9bc136def0712717ac040ab549f5539ccbd3dfaf9e17040281

Download Submit
C:\Windows\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe

Filesize
192KB

MD5
020c08b014820a08ad706e99e9d33709

SHA1
ff4d252e76ce433588f150d24345f5dc3fc64fbb

SHA256
5d6815a97a5732e8db25330eaa66ae79024c342d5f4cbf62c531b5a0b183966b

SHA512
9a768f7817b8ed7bc7484d2fa8527efa5b56bc324d85e8efc4bf91a01161355a05f42f3618dc76728702ce46d55934c85d597af6ab3d214ccc244e14e31e4259

Download Submit
C:\Windows\{5E4016F4-1DF4-44b1-8902-8F8CE3682FC2}.exe

Filesize
192KB

MD5
020c08b014820a08ad706e99e9d33709

SHA1
ff4d252e76ce433588f150d24345f5dc3fc64fbb

SHA256
5d6815a97a5732e8db25330eaa66ae79024c342d5f4cbf62c531b5a0b183966b

SHA512
9a768f7817b8ed7bc7484d2fa8527efa5b56bc324d85e8efc4bf91a01161355a05f42f3618dc76728702ce46d55934c85d597af6ab3d214ccc244e14e31e4259

Download Submit
C:\Windows\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe

Filesize
192KB

MD5
2b0eaf572776760634e2491805d85ef3

SHA1
ff7a8802e18fb11390a312988f4b0952f7f29f77

SHA256
5da0c1b066fe205b59184c9f740a02aeb8416b0ccce97ad009bc7b10aefed9e7

SHA512
1b2621cfc8e560be895e621b382dd3a5c5e6919b3083e807acd01e89fb01bba8384917a580509bafc4d75df571a7d0371f3f25427319a9f20b1a660fe76042df

Download Submit
C:\Windows\{8D6E9C42-2F63-48fd-82FE-9A64D698CB69}.exe

Filesize
192KB

MD5
2b0eaf572776760634e2491805d85ef3

SHA1
ff7a8802e18fb11390a312988f4b0952f7f29f77

SHA256
5da0c1b066fe205b59184c9f740a02aeb8416b0ccce97ad009bc7b10aefed9e7

SHA512
1b2621cfc8e560be895e621b382dd3a5c5e6919b3083e807acd01e89fb01bba8384917a580509bafc4d75df571a7d0371f3f25427319a9f20b1a660fe76042df

Download Submit
C:\Windows\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe

Filesize
192KB

MD5
c747848a750a2228e2902a3b4a6c3e49

SHA1
b476ef12ea9beaf97bedee08b1e4e8c8db4ccbe0

SHA256
6bf8d3f70af2d480df0cb97d61dcde580d9f5caa63d3cabc1059a2ead28989cc

SHA512
ebb9310d1a15367c68e2d97ac713d86109c85be6b8bdd12c44fec3834fa66affd8b3523e0af1d09eac44a49aa4aa79b33d427003ac309dd6cba38d47aac18668

Download Submit
C:\Windows\{904411E9-C121-4a9d-BC9A-EB27DA4D776C}.exe

Filesize
192KB

MD5
c747848a750a2228e2902a3b4a6c3e49

SHA1
b476ef12ea9beaf97bedee08b1e4e8c8db4ccbe0

SHA256
6bf8d3f70af2d480df0cb97d61dcde580d9f5caa63d3cabc1059a2ead28989cc

SHA512
ebb9310d1a15367c68e2d97ac713d86109c85be6b8bdd12c44fec3834fa66affd8b3523e0af1d09eac44a49aa4aa79b33d427003ac309dd6cba38d47aac18668

Download Submit
C:\Windows\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe

Filesize
192KB

MD5
a0ac4d9c578f5f6bc3197d2bc205d6b7

SHA1
f7bb2c76cfb5707bf271da3adb4fb64ec6ca0ba5

SHA256
4b800fc44202e6fd26aa1dc8e0fb1847a8ff0e8c6477dac6ccc97f23694643c4

SHA512
45d8df32965a908d9d17c576028bd8080cea7c37bb9fd922d641362a8c515f27832d73cc0cf6347b8d3388f266a7c8f2e3428f5d77752cb7e4fc3b39333a3e83

Download Submit
C:\Windows\{9AB7391E-76D9-43f0-9D92-B92C0B9EA433}.exe

Filesize
192KB

MD5
a0ac4d9c578f5f6bc3197d2bc205d6b7

SHA1
f7bb2c76cfb5707bf271da3adb4fb64ec6ca0ba5

SHA256
4b800fc44202e6fd26aa1dc8e0fb1847a8ff0e8c6477dac6ccc97f23694643c4

SHA512
45d8df32965a908d9d17c576028bd8080cea7c37bb9fd922d641362a8c515f27832d73cc0cf6347b8d3388f266a7c8f2e3428f5d77752cb7e4fc3b39333a3e83

Download Submit
C:\Windows\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe

Filesize
192KB

MD5
2ede4fe2f296316cf104ced7d69f9520

SHA1
92ee08ad7e99c6b66758a34173ea6a1eaca33533

SHA256
341f905b1317cab7a019dbaf78791b91bb55699ef9f645af9f696cf67a611b82

SHA512
97c985a20cdfed0f68905928e1386a26d67f4b45793c26c6dbac0002d7952b40252b2eb697412f7f89b03f8b497f99c91791a3be189cc9f239ef170aa07cc7d2

Download Submit
C:\Windows\{A0DD2C85-B38B-4860-B892-5FCDFFD6E216}.exe

Filesize
192KB

MD5
2ede4fe2f296316cf104ced7d69f9520

SHA1
92ee08ad7e99c6b66758a34173ea6a1eaca33533

SHA256
341f905b1317cab7a019dbaf78791b91bb55699ef9f645af9f696cf67a611b82

SHA512
97c985a20cdfed0f68905928e1386a26d67f4b45793c26c6dbac0002d7952b40252b2eb697412f7f89b03f8b497f99c91791a3be189cc9f239ef170aa07cc7d2

Download Submit
C:\Windows\{A8890301-1251-4c60-9A96-AA85640BF882}.exe

Filesize
192KB

MD5
2664969b773a352146e7dadcba676eb7

SHA1
0cbdb4613e7f18083ce8e9d51c5e6fadb41d9b1a

SHA256
5b58b6bc4283970c893f4db261cefa42c6c2fc26c7073a24a03d0950261fb52b

SHA512
75d27ae42ab42c96c4c24c19debd21b739ea32202ddfb7ec115dde5ee8d2651dd75d727f60eabc9c3b6e77d0bb035ecae14abac9c0bd5510d3bc7e0c114097b8

Download Submit
C:\Windows\{A8890301-1251-4c60-9A96-AA85640BF882}.exe

Filesize
192KB

MD5
2664969b773a352146e7dadcba676eb7

SHA1
0cbdb4613e7f18083ce8e9d51c5e6fadb41d9b1a

SHA256
5b58b6bc4283970c893f4db261cefa42c6c2fc26c7073a24a03d0950261fb52b

SHA512
75d27ae42ab42c96c4c24c19debd21b739ea32202ddfb7ec115dde5ee8d2651dd75d727f60eabc9c3b6e77d0bb035ecae14abac9c0bd5510d3bc7e0c114097b8

Download Submit
C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe

Filesize
192KB

MD5
aa75ad0e948ce4841b30ba6ffd35c33e

SHA1
a0518cc9b9727c8ad0f80d78703f088f052fb68e

SHA256
4f6a4f293493c86ae38e0695d1233d68d5a2627c4fddb440ebf4e88eacc59f05

SHA512
ab237a97ed58f28a355d81a61335e6f772d8ddaafb7bcca0a17f4f98a88eeef75504eeb1db6a20f8f1e0c61794419afa52f08252f3bd299d5580d0ae8257241f

Download Submit
C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe

Filesize
192KB

MD5
aa75ad0e948ce4841b30ba6ffd35c33e

SHA1
a0518cc9b9727c8ad0f80d78703f088f052fb68e

SHA256
4f6a4f293493c86ae38e0695d1233d68d5a2627c4fddb440ebf4e88eacc59f05

SHA512
ab237a97ed58f28a355d81a61335e6f772d8ddaafb7bcca0a17f4f98a88eeef75504eeb1db6a20f8f1e0c61794419afa52f08252f3bd299d5580d0ae8257241f

Download Submit
C:\Windows\{FC13297F-4146-4617-AE58-2A4294C86D68}.exe

Filesize
192KB

MD5
aa75ad0e948ce4841b30ba6ffd35c33e

SHA1
a0518cc9b9727c8ad0f80d78703f088f052fb68e

SHA256
4f6a4f293493c86ae38e0695d1233d68d5a2627c4fddb440ebf4e88eacc59f05

SHA512
ab237a97ed58f28a355d81a61335e6f772d8ddaafb7bcca0a17f4f98a88eeef75504eeb1db6a20f8f1e0c61794419afa52f08252f3bd299d5580d0ae8257241f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads