1d0dd6d8e4cdfcfa609f149d370d95ee3959d6acf7c28afbc033115d1acccce6

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
Size

216KB
MD5

3c7769f4620c2f20e76606aba6e87419
SHA1

75eef44f9adf7c635324f87d06f6c13da57c42d1
SHA256

1d0dd6d8e4cdfcfa609f149d370d95ee3959d6acf7c28afbc033115d1acccce6
SHA512

656bbacd84d850e2ed8d72800ea47301fe784f31d35204cb67f5d9a14c29e91d9d81b75b14b9dc6d66e672fc695f666d6dfdf652a10f2d0e999e5ecbc10c955c
SSDEEP

3072:jEGh0oil+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGYlEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}\stubpath = "C:\\Windows\\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe"	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}\stubpath = "C:\\Windows\\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe"	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}	{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{590E19A2-3EFB-4534-B460-640B0AED2644}	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{590E19A2-3EFB-4534-B460-640B0AED2644}\stubpath = "C:\\Windows\\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe"	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2537378F-47D9-49d6-84DD-ABE672187B06}	{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}\stubpath = "C:\\Windows\\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe"	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}\stubpath = "C:\\Windows\\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe"	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BA3ACC6-4637-4df4-90CC-AA5252847220}\stubpath = "C:\\Windows\\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe"	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}\stubpath = "C:\\Windows\\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe"	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}\stubpath = "C:\\Windows\\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe"	{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2537378F-47D9-49d6-84DD-ABE672187B06}\stubpath = "C:\\Windows\\{2537378F-47D9-49d6-84DD-ABE672187B06}.exe"	{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}\stubpath = "C:\\Windows\\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe"	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BA3ACC6-4637-4df4-90CC-AA5252847220}	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}	{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}\stubpath = "C:\\Windows\\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe"	{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe

Deletes itself 1 IoCs

pid	Process
2368	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
2996	{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
1216	{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
2556	{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
2396	{2537378F-47D9-49d6-84DD-ABE672187B06}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
File created	C:\Windows\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe	{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
File created	C:\Windows\{2537378F-47D9-49d6-84DD-ABE672187B06}.exe	{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
File created	C:\Windows\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
File created	C:\Windows\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
File created	C:\Windows\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
File created	C:\Windows\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
File created	C:\Windows\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
File created	C:\Windows\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe	{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
File created	C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
File created	C:\Windows\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
Token: SeIncBasePriorityPrivilege	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
Token: SeIncBasePriorityPrivilege	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
Token: SeIncBasePriorityPrivilege	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
Token: SeIncBasePriorityPrivilege	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
Token: SeIncBasePriorityPrivilege	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
Token: SeIncBasePriorityPrivilege	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
Token: SeIncBasePriorityPrivilege	2996	{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
Token: SeIncBasePriorityPrivilege	1216	{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
Token: SeIncBasePriorityPrivilege	2556	{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1092	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	28
PID 1644 wrote to memory of 1092	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	28
PID 1644 wrote to memory of 1092	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	28
PID 1644 wrote to memory of 1092	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	28
PID 1644 wrote to memory of 2368	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	29
PID 1644 wrote to memory of 2368	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	29
PID 1644 wrote to memory of 2368	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	29
PID 1644 wrote to memory of 2368	1644	2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe	29
PID 1092 wrote to memory of 2620	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	30
PID 1092 wrote to memory of 2620	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	30
PID 1092 wrote to memory of 2620	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	30
PID 1092 wrote to memory of 2620	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	30
PID 1092 wrote to memory of 2776	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	31
PID 1092 wrote to memory of 2776	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	31
PID 1092 wrote to memory of 2776	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	31
PID 1092 wrote to memory of 2776	1092	{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe	31
PID 2620 wrote to memory of 2924	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	33
PID 2620 wrote to memory of 2924	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	33
PID 2620 wrote to memory of 2924	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	33
PID 2620 wrote to memory of 2924	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	33
PID 2620 wrote to memory of 2928	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	32
PID 2620 wrote to memory of 2928	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	32
PID 2620 wrote to memory of 2928	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	32
PID 2620 wrote to memory of 2928	2620	{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe	32
PID 2924 wrote to memory of 1896	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	36
PID 2924 wrote to memory of 1896	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	36
PID 2924 wrote to memory of 1896	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	36
PID 2924 wrote to memory of 1896	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	36
PID 2924 wrote to memory of 2196	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	37
PID 2924 wrote to memory of 2196	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	37
PID 2924 wrote to memory of 2196	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	37
PID 2924 wrote to memory of 2196	2924	{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe	37
PID 1896 wrote to memory of 2512	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	39
PID 1896 wrote to memory of 2512	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	39
PID 1896 wrote to memory of 2512	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	39
PID 1896 wrote to memory of 2512	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	39
PID 1896 wrote to memory of 2580	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	38
PID 1896 wrote to memory of 2580	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	38
PID 1896 wrote to memory of 2580	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	38
PID 1896 wrote to memory of 2580	1896	{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe	38
PID 2512 wrote to memory of 2348	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	40
PID 2512 wrote to memory of 2348	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	40
PID 2512 wrote to memory of 2348	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	40
PID 2512 wrote to memory of 2348	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	40
PID 2512 wrote to memory of 1656	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	41
PID 2512 wrote to memory of 1656	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	41
PID 2512 wrote to memory of 1656	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	41
PID 2512 wrote to memory of 1656	2512	{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe	41
PID 2348 wrote to memory of 1860	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	42
PID 2348 wrote to memory of 1860	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	42
PID 2348 wrote to memory of 1860	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	42
PID 2348 wrote to memory of 1860	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	42
PID 2348 wrote to memory of 2972	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	43
PID 2348 wrote to memory of 2972	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	43
PID 2348 wrote to memory of 2972	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	43
PID 2348 wrote to memory of 2972	2348	{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe	43
PID 1860 wrote to memory of 2996	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	44
PID 1860 wrote to memory of 2996	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	44
PID 1860 wrote to memory of 2996	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	44
PID 1860 wrote to memory of 2996	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	44
PID 1860 wrote to memory of 2984	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	45
PID 1860 wrote to memory of 2984	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	45
PID 1860 wrote to memory of 2984	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	45
PID 1860 wrote to memory of 2984	1860	{590E19A2-3EFB-4534-B460-640B0AED2644}.exe	45

C:\Users\Admin\AppData\Local\Temp\2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_3c7769f4620c2f20e76606aba6e87419_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
  C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
    C:\Windows\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{977F6~1.EXE > nul
      4⤵
      PID:2928
  - - C:\Windows\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
      C:\Windows\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Windows\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
        
        C:\Windows\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1BA3A~1.EXE > nul
        6⤵
        
        PID:2580
      - C:\Windows\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
        
        C:\Windows\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
        
        C:\Windows\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
        
        C:\Windows\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
        
        C:\Windows\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31433~1.EXE > nul
        10⤵
        
        PID:2332
        
        C:\Windows\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
        
        C:\Windows\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Windows\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
        
        C:\Windows\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\{2537378F-47D9-49d6-84DD-ABE672187B06}.exe
        
        C:\Windows\{2537378F-47D9-49d6-84DD-ABE672187B06}.exe
        12⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F649C~1.EXE > nul
        12⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{35DB8~1.EXE > nul
        11⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{590E1~1.EXE > nul
        9⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8E354~1.EXE > nul
        8⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9C49~1.EXE > nul
        7⤵
        
        PID:1656
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A9F5F~1.EXE > nul
        5⤵
        
        PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4DCC7~1.EXE > nul
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe

Filesize
216KB

MD5
86ae13859b22c34551c7c8783286eecf

SHA1
281ecc226bc639d73285b1a3dce10dfffce51428

SHA256
a08b8fefcf06cc9439d64305c2e976a1f7378272999c96f87a713e64a59f4368

SHA512
7f8dc1bba5b2f3572b46d4981d0b4fa775bb7b4e0b828ccf9a42ab93a7c6cc1e784fb4d1d9d61548745a103d345d31d7ff2d3964975e96758585886a45e1df8f

Download Submit
C:\Windows\{1BA3ACC6-4637-4df4-90CC-AA5252847220}.exe

Filesize
216KB

MD5
86ae13859b22c34551c7c8783286eecf

SHA1
281ecc226bc639d73285b1a3dce10dfffce51428

SHA256
a08b8fefcf06cc9439d64305c2e976a1f7378272999c96f87a713e64a59f4368

SHA512
7f8dc1bba5b2f3572b46d4981d0b4fa775bb7b4e0b828ccf9a42ab93a7c6cc1e784fb4d1d9d61548745a103d345d31d7ff2d3964975e96758585886a45e1df8f

Download Submit
C:\Windows\{2537378F-47D9-49d6-84DD-ABE672187B06}.exe

Filesize
216KB

MD5
06d033268cac1a4bacee25c2213f297e

SHA1
9c393dd36fe8cb9f74705f8aad99b40da219cefb

SHA256
3ad2e9a95c769f95bb7397ef4c97d89db77979ebf27a3d33025b8fb9f9f685fa

SHA512
45267e06a7a3329de17d8fb626e60d90f40601cc04c49d6e772268a2aa797b8b81f6c2c06e8c10fc785833684b101b6b18011a3cfb33e8b923d64c304e6de784

Download Submit
C:\Windows\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe

Filesize
216KB

MD5
2903937467ef91870a12010bdada93a1

SHA1
a5a9cd70a0ebabfb5ca67a9ef3cac7f2c7cb7737

SHA256
9e8d70e29c3e9a5680e28db93933a1673f42e7ea5bf1cdfde20e7ee92294b5b1

SHA512
0d18a13e1dff2531da07705963c95b5b83d11c3d5d87360ec7cf1027847459e25a09ee6bf0b4fb44953159615e6b350117ebb83194848d5fd09e0f5fa6775c55

Download Submit
C:\Windows\{31433D3F-4856-4e72-85D6-9BA57BB3ABD0}.exe

Filesize
216KB

MD5
2903937467ef91870a12010bdada93a1

SHA1
a5a9cd70a0ebabfb5ca67a9ef3cac7f2c7cb7737

SHA256
9e8d70e29c3e9a5680e28db93933a1673f42e7ea5bf1cdfde20e7ee92294b5b1

SHA512
0d18a13e1dff2531da07705963c95b5b83d11c3d5d87360ec7cf1027847459e25a09ee6bf0b4fb44953159615e6b350117ebb83194848d5fd09e0f5fa6775c55

Download Submit
C:\Windows\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe

Filesize
216KB

MD5
916467f8b69958fe0586ebd3cc3ccfac

SHA1
ae0be1f895574e34c8d58c94b3a66b9ba11dc3fd

SHA256
df7c45e75c3b22288752a5b1c278f973d713c4463aa0e9827578731b9d3f493c

SHA512
4e3da1421a8f75c3f798592f81907a79e97377477a67809a586ac2834cd9c996db7b71b464209a1793f1f233e13bfab814642cbbead5bbc22f8815ca8bcaf300

Download Submit
C:\Windows\{35DB8618-3177-4ec6-AFB0-ACA3D1AE4192}.exe

Filesize
216KB

MD5
916467f8b69958fe0586ebd3cc3ccfac

SHA1
ae0be1f895574e34c8d58c94b3a66b9ba11dc3fd

SHA256
df7c45e75c3b22288752a5b1c278f973d713c4463aa0e9827578731b9d3f493c

SHA512
4e3da1421a8f75c3f798592f81907a79e97377477a67809a586ac2834cd9c996db7b71b464209a1793f1f233e13bfab814642cbbead5bbc22f8815ca8bcaf300

Download Submit
C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe

Filesize
216KB

MD5
b109a52d47a93bed746975eed16717e5

SHA1
82b68d4855ad9e7bb1b2ad5f7cdb95ff64ce321e

SHA256
756dab71fa1b2384c2f819c7970f12fbd6780288b2bfd7b071712a6df807900e

SHA512
b38d23d7460077b3d01b6549a6b49743afb11b162a204cd0975f0e9c77061f3711cd03773185b18ff5c260b26831c3ee9b363ce82809cc570129a98697673721

Download Submit
C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe

Filesize
216KB

MD5
b109a52d47a93bed746975eed16717e5

SHA1
82b68d4855ad9e7bb1b2ad5f7cdb95ff64ce321e

SHA256
756dab71fa1b2384c2f819c7970f12fbd6780288b2bfd7b071712a6df807900e

SHA512
b38d23d7460077b3d01b6549a6b49743afb11b162a204cd0975f0e9c77061f3711cd03773185b18ff5c260b26831c3ee9b363ce82809cc570129a98697673721

Download Submit
C:\Windows\{4DCC7CE4-FD30-41b3-81DB-947EE03AAADE}.exe

Filesize
216KB

MD5
b109a52d47a93bed746975eed16717e5

SHA1
82b68d4855ad9e7bb1b2ad5f7cdb95ff64ce321e

SHA256
756dab71fa1b2384c2f819c7970f12fbd6780288b2bfd7b071712a6df807900e

SHA512
b38d23d7460077b3d01b6549a6b49743afb11b162a204cd0975f0e9c77061f3711cd03773185b18ff5c260b26831c3ee9b363ce82809cc570129a98697673721

Download Submit
C:\Windows\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe

Filesize
216KB

MD5
dfeb69bd4117ae921a96b30d9fe491a2

SHA1
578cafa0103e7a8c60371302bf84337343ba0e6a

SHA256
62e56e256f3c3cce8118cea425a829bf443e237befd00a44514ea00ec3a28b6e

SHA512
dfebdf6cbbdf6f825f08ef7bac61d6c04065e0230f8873a957200744b10dda927e9b1704bffb0dd6dc923d924dc1cfdc75c6e9e661a28ff330aa249d6b746828

Download Submit
C:\Windows\{590E19A2-3EFB-4534-B460-640B0AED2644}.exe

Filesize
216KB

MD5
dfeb69bd4117ae921a96b30d9fe491a2

SHA1
578cafa0103e7a8c60371302bf84337343ba0e6a

SHA256
62e56e256f3c3cce8118cea425a829bf443e237befd00a44514ea00ec3a28b6e

SHA512
dfebdf6cbbdf6f825f08ef7bac61d6c04065e0230f8873a957200744b10dda927e9b1704bffb0dd6dc923d924dc1cfdc75c6e9e661a28ff330aa249d6b746828

Download Submit
C:\Windows\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe

Filesize
216KB

MD5
0cc4f67ca2e08df0fec5c4566dad748f

SHA1
6257ed3a01508728b55e7a31c51750a13f85be77

SHA256
735e3ebd9dc16a687e14f7173b7f417e3d4d09a07e15253c0ca4cd70fb386be6

SHA512
7e9c9b9691c77bebf6df589545c7e1f6f9c7551de7dc4b6514508e096eeb00dd7ce7baff3adc691dbb90ba4ba88aea56904ffaae06cc4ec235100661a9fb953f

Download Submit
C:\Windows\{8E354EB9-AF58-416a-93D8-D0F7D62E942D}.exe

Filesize
216KB

MD5
0cc4f67ca2e08df0fec5c4566dad748f

SHA1
6257ed3a01508728b55e7a31c51750a13f85be77

SHA256
735e3ebd9dc16a687e14f7173b7f417e3d4d09a07e15253c0ca4cd70fb386be6

SHA512
7e9c9b9691c77bebf6df589545c7e1f6f9c7551de7dc4b6514508e096eeb00dd7ce7baff3adc691dbb90ba4ba88aea56904ffaae06cc4ec235100661a9fb953f

Download Submit
C:\Windows\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe

Filesize
216KB

MD5
6ac6909be6552458ce077b95252cd40f

SHA1
054e31520745d2c972c2d2e946af157de3bfdaac

SHA256
0d548241a7a3cbf253c550df23537c97dcdaebf2e0e0fcfb98725a1e867a363c

SHA512
274cf3e9252365a84702694edb190a215aecc22d3ae13bae2b9d0ac63d3b147ba2276446ca7be64ef9554057cb670e472e056a05c9b4b4b58d321a703d4bd61a

Download Submit
C:\Windows\{977F6962-2EB8-4eee-A0A7-34A1CC8E63BC}.exe

Filesize
216KB

MD5
6ac6909be6552458ce077b95252cd40f

SHA1
054e31520745d2c972c2d2e946af157de3bfdaac

SHA256
0d548241a7a3cbf253c550df23537c97dcdaebf2e0e0fcfb98725a1e867a363c

SHA512
274cf3e9252365a84702694edb190a215aecc22d3ae13bae2b9d0ac63d3b147ba2276446ca7be64ef9554057cb670e472e056a05c9b4b4b58d321a703d4bd61a

Download Submit
C:\Windows\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe

Filesize
216KB

MD5
612b3b85a45b2d11f1b063083294883c

SHA1
9a4ca2d123248c137bdedc7d0ddf5c1784510812

SHA256
c5d3b6c754edc044db08d2c88cb36a61cc83f147245c301346ede00829f3f9fd

SHA512
17af5b80744cdabf2f9388e4bf69b3b8fefe99d55d4a2fd2b419c220ccc9fbf6e14ac11a5c812f60fff70e9331b88e58db2c6432dc6a470587e633c04d0003ec

Download Submit
C:\Windows\{A9F5FA0E-0795-48ca-9402-E80BAB3C9FEF}.exe

Filesize
216KB

MD5
612b3b85a45b2d11f1b063083294883c

SHA1
9a4ca2d123248c137bdedc7d0ddf5c1784510812

SHA256
c5d3b6c754edc044db08d2c88cb36a61cc83f147245c301346ede00829f3f9fd

SHA512
17af5b80744cdabf2f9388e4bf69b3b8fefe99d55d4a2fd2b419c220ccc9fbf6e14ac11a5c812f60fff70e9331b88e58db2c6432dc6a470587e633c04d0003ec

Download Submit
C:\Windows\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe

Filesize
216KB

MD5
f52519ead753518555f14a9be30c8950

SHA1
b077b68d63ef5d5657b981589b956e9999890373

SHA256
a971b7a381fcc2ff7bd014be9d9e2475b5d47c6954402df7ae087533ecfc16f0

SHA512
2e36fe958e441cef99c7e0281a2949041142e189f4dde7b62b2ce5ef11350698a118a804565a47a684b0c9e1866899a3d40887ef188c79e5cbdb60dd3b3c9a12

Download Submit
C:\Windows\{C9C491C4-7EE4-468a-A302-5FF5E77E3E35}.exe

Filesize
216KB

MD5
f52519ead753518555f14a9be30c8950

SHA1
b077b68d63ef5d5657b981589b956e9999890373

SHA256
a971b7a381fcc2ff7bd014be9d9e2475b5d47c6954402df7ae087533ecfc16f0

SHA512
2e36fe958e441cef99c7e0281a2949041142e189f4dde7b62b2ce5ef11350698a118a804565a47a684b0c9e1866899a3d40887ef188c79e5cbdb60dd3b3c9a12

Download Submit
C:\Windows\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe

Filesize
216KB

MD5
750e55a5b408fca782a1c9dd90c04739

SHA1
0f61af36e3099bb60e352556f28d5072ec0ff3c3

SHA256
ced9be64716a186d5d810716de78946af55c0cb2a4a9e5e3d62294187d1b9e06

SHA512
83f880cd560853a18dc43f51471c8407f765aa7ab31ba6632d60a9c439d6727b1cd894d2b17b8fc43840855f1253c88bbf9c597f648ef83777fc9aeed421ef59

Download Submit
C:\Windows\{F649CF2F-8C46-496f-BB9D-F5C469D82E4F}.exe

Filesize
216KB

MD5
750e55a5b408fca782a1c9dd90c04739

SHA1
0f61af36e3099bb60e352556f28d5072ec0ff3c3

SHA256
ced9be64716a186d5d810716de78946af55c0cb2a4a9e5e3d62294187d1b9e06

SHA512
83f880cd560853a18dc43f51471c8407f765aa7ab31ba6632d60a9c439d6727b1cd894d2b17b8fc43840855f1253c88bbf9c597f648ef83777fc9aeed421ef59

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads