d210ed055a93107ca757c129f1277a3a1f0e13a43443acfebf4ce335e705690e

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe
Size

168KB
MD5

60023a1193d54cee131d00283ae4353e
SHA1

2bbed9f72a0cf9f9d1bd2bf80e5871c3f27aadb8
SHA256

d210ed055a93107ca757c129f1277a3a1f0e13a43443acfebf4ce335e705690e
SHA512

3176407aa87f44d334127ebb01f14cfd2b02758a2919865dcc8f792d7fcb620aca0e09ff65eeb938f3f4f1f26d2921021891f45701d8785c0b52c3dae877a19e
SSDEEP

1536:1EGh0o+lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+lqOPOe2MUVg3Ve+rX

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93F0123C-4507-43a2-A2C8-7C641636EB26}	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}\stubpath = "C:\\Windows\\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe"	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFFEC5A0-D402-4cae-850B-78531712176B}\stubpath = "C:\\Windows\\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe"	{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCC92091-701D-470e-9613-FFD7CD31919A}\stubpath = "C:\\Windows\\{FCC92091-701D-470e-9613-FFD7CD31919A}.exe"	{AFFEC5A0-D402-4cae-850B-78531712176B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{058C8C09-1784-46e7-AF74-943D4B88621A}	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{058C8C09-1784-46e7-AF74-943D4B88621A}\stubpath = "C:\\Windows\\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe"	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7E7C587-50A0-46f1-8F40-462739FAA551}	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7E7C587-50A0-46f1-8F40-462739FAA551}\stubpath = "C:\\Windows\\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe"	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C804CD71-86B5-4bca-A6E4-26D145325A3D}	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C804CD71-86B5-4bca-A6E4-26D145325A3D}\stubpath = "C:\\Windows\\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe"	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}	{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{93F0123C-4507-43a2-A2C8-7C641636EB26}\stubpath = "C:\\Windows\\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe"	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2EB8B58-24E2-4329-8210-14AA836204C9}	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}\stubpath = "C:\\Windows\\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe"	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}\stubpath = "C:\\Windows\\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe"	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2EB8B58-24E2-4329-8210-14AA836204C9}\stubpath = "C:\\Windows\\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe"	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}\stubpath = "C:\\Windows\\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe"	{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFFEC5A0-D402-4cae-850B-78531712176B}	{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCC92091-701D-470e-9613-FFD7CD31919A}	{AFFEC5A0-D402-4cae-850B-78531712176B}.exe

Deletes itself 1 IoCs

pid	Process
2376	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
2856	{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
1640	{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
1752	{AFFEC5A0-D402-4cae-850B-78531712176B}.exe
1692	{FCC92091-701D-470e-9613-FFD7CD31919A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
File created	C:\Windows\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
File created	C:\Windows\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe	{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
File created	C:\Windows\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe	{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
File created	C:\Windows\{FCC92091-701D-470e-9613-FFD7CD31919A}.exe	{AFFEC5A0-D402-4cae-850B-78531712176B}.exe
File created	C:\Windows\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
File created	C:\Windows\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
File created	C:\Windows\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
File created	C:\Windows\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
File created	C:\Windows\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
File created	C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
Token: SeIncBasePriorityPrivilege	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
Token: SeIncBasePriorityPrivilege	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
Token: SeIncBasePriorityPrivilege	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
Token: SeIncBasePriorityPrivilege	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
Token: SeIncBasePriorityPrivilege	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
Token: SeIncBasePriorityPrivilege	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
Token: SeIncBasePriorityPrivilege	2856	{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
Token: SeIncBasePriorityPrivilege	1640	{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
Token: SeIncBasePriorityPrivilege	1752	{AFFEC5A0-D402-4cae-850B-78531712176B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2128	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	28
PID 1080 wrote to memory of 2128	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	28
PID 1080 wrote to memory of 2128	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	28
PID 1080 wrote to memory of 2128	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	28
PID 1080 wrote to memory of 2376	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	29
PID 1080 wrote to memory of 2376	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	29
PID 1080 wrote to memory of 2376	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	29
PID 1080 wrote to memory of 2376	1080	2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe	29
PID 2128 wrote to memory of 2756	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	30
PID 2128 wrote to memory of 2756	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	30
PID 2128 wrote to memory of 2756	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	30
PID 2128 wrote to memory of 2756	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	30
PID 2128 wrote to memory of 2944	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	31
PID 2128 wrote to memory of 2944	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	31
PID 2128 wrote to memory of 2944	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	31
PID 2128 wrote to memory of 2944	2128	{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe	31
PID 2756 wrote to memory of 2936	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	32
PID 2756 wrote to memory of 2936	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	32
PID 2756 wrote to memory of 2936	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	32
PID 2756 wrote to memory of 2936	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	32
PID 2756 wrote to memory of 2932	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	33
PID 2756 wrote to memory of 2932	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	33
PID 2756 wrote to memory of 2932	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	33
PID 2756 wrote to memory of 2932	2756	{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe	33
PID 2936 wrote to memory of 2544	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	36
PID 2936 wrote to memory of 2544	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	36
PID 2936 wrote to memory of 2544	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	36
PID 2936 wrote to memory of 2544	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	36
PID 2936 wrote to memory of 2492	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	37
PID 2936 wrote to memory of 2492	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	37
PID 2936 wrote to memory of 2492	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	37
PID 2936 wrote to memory of 2492	2936	{058C8C09-1784-46e7-AF74-943D4B88621A}.exe	37
PID 2544 wrote to memory of 2528	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	38
PID 2544 wrote to memory of 2528	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	38
PID 2544 wrote to memory of 2528	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	38
PID 2544 wrote to memory of 2528	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	38
PID 2544 wrote to memory of 2616	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	39
PID 2544 wrote to memory of 2616	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	39
PID 2544 wrote to memory of 2616	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	39
PID 2544 wrote to memory of 2616	2544	{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe	39
PID 2528 wrote to memory of 2324	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	40
PID 2528 wrote to memory of 2324	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	40
PID 2528 wrote to memory of 2324	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	40
PID 2528 wrote to memory of 2324	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	40
PID 2528 wrote to memory of 2116	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	41
PID 2528 wrote to memory of 2116	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	41
PID 2528 wrote to memory of 2116	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	41
PID 2528 wrote to memory of 2116	2528	{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe	41
PID 2324 wrote to memory of 828	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	42
PID 2324 wrote to memory of 828	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	42
PID 2324 wrote to memory of 828	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	42
PID 2324 wrote to memory of 828	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	42
PID 2324 wrote to memory of 2728	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	43
PID 2324 wrote to memory of 2728	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	43
PID 2324 wrote to memory of 2728	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	43
PID 2324 wrote to memory of 2728	2324	{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe	43
PID 828 wrote to memory of 2856	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	44
PID 828 wrote to memory of 2856	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	44
PID 828 wrote to memory of 2856	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	44
PID 828 wrote to memory of 2856	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	44
PID 828 wrote to memory of 2844	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	45
PID 828 wrote to memory of 2844	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	45
PID 828 wrote to memory of 2844	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	45
PID 828 wrote to memory of 2844	828	{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe	45

C:\Users\Admin\AppData\Local\Temp\2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_60023a1193d54cee131d00283ae4353e_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
  C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
    C:\Windows\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
      C:\Windows\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Windows\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
        
        C:\Windows\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2544
      - C:\Windows\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
        
        C:\Windows\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
        
        C:\Windows\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
        
        C:\Windows\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
        
        C:\Windows\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
        
        C:\Windows\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
        
        C:\Windows\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe
        
        C:\Windows\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\{FCC92091-701D-470e-9613-FFD7CD31919A}.exe
        
        C:\Windows\{FCC92091-701D-470e-9613-FFD7CD31919A}.exe
        12⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AFFEC~1.EXE > nul
        12⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69D1A~1.EXE > nul
        11⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C804C~1.EXE > nul
        10⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7E7C~1.EXE > nul
        9⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9021~1.EXE > nul
        8⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C120C~1.EXE > nul
        7⤵
        
        PID:2116
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C05EC~1.EXE > nul
        6⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{058C8~1.EXE > nul
        5⤵
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E2EB8~1.EXE > nul
      4⤵
      PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{93F01~1.EXE > nul
    3⤵
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe

Filesize
168KB

MD5
5aa2d9892c2d922c118bb6ba6c6e62a2

SHA1
3292a14e3c32f695ff83923adfd7bd519e452c6d

SHA256
a1083a2f6f1cdfc5d045d076012d815d5ea09f3c6fbe2998a6c0d55a0afe849b

SHA512
67a0125ecea499928158d97ce20535ede755cb5b8460f822ceb9641dbb5b5f1fab11d8787541f336e776a629159ab87226eac089c9bc7d2a9fd9e86637441859

Download Submit
C:\Windows\{058C8C09-1784-46e7-AF74-943D4B88621A}.exe

Filesize
168KB

MD5
5aa2d9892c2d922c118bb6ba6c6e62a2

SHA1
3292a14e3c32f695ff83923adfd7bd519e452c6d

SHA256
a1083a2f6f1cdfc5d045d076012d815d5ea09f3c6fbe2998a6c0d55a0afe849b

SHA512
67a0125ecea499928158d97ce20535ede755cb5b8460f822ceb9641dbb5b5f1fab11d8787541f336e776a629159ab87226eac089c9bc7d2a9fd9e86637441859

Download Submit
C:\Windows\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe

Filesize
168KB

MD5
2786642d905b47823f43eddca1b64101

SHA1
f03eddfe25077e67e4f45caee8ce5c01a383f496

SHA256
200992fc0049897ef327a47d6e8aa830f34e05955f03b8478c5391152f5f3473

SHA512
4395c9017f70c3226d2d467bd5911e3c57023ee9793b60918ea4ccb6bc05e05cb866cc37863ca7369332d4dffa346487e7e0c6325d7739ac8e72198a01e476fa

Download Submit
C:\Windows\{69D1AA4B-3223-4832-A017-2D8EE7EC0346}.exe

Filesize
168KB

MD5
2786642d905b47823f43eddca1b64101

SHA1
f03eddfe25077e67e4f45caee8ce5c01a383f496

SHA256
200992fc0049897ef327a47d6e8aa830f34e05955f03b8478c5391152f5f3473

SHA512
4395c9017f70c3226d2d467bd5911e3c57023ee9793b60918ea4ccb6bc05e05cb866cc37863ca7369332d4dffa346487e7e0c6325d7739ac8e72198a01e476fa

Download Submit
C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe

Filesize
168KB

MD5
39d5be66b078d522ea23288df4252bf9

SHA1
3ab05d4ff8acd15460167bf11b2098c2a72123c9

SHA256
32afee4eaa4a7d77408b8c5de2845f4b736bebdf001952b2c4085e385a5dfd21

SHA512
2dd43c6206407e963662b0d689af22e3c9e37d09b9158504885c65b72cf82b62ba94b0f97efb3ef596e2023d14d83dd29e2698f5d685cbda54e887f7e77da979

Download Submit
C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe

Filesize
168KB

MD5
39d5be66b078d522ea23288df4252bf9

SHA1
3ab05d4ff8acd15460167bf11b2098c2a72123c9

SHA256
32afee4eaa4a7d77408b8c5de2845f4b736bebdf001952b2c4085e385a5dfd21

SHA512
2dd43c6206407e963662b0d689af22e3c9e37d09b9158504885c65b72cf82b62ba94b0f97efb3ef596e2023d14d83dd29e2698f5d685cbda54e887f7e77da979

Download Submit
C:\Windows\{93F0123C-4507-43a2-A2C8-7C641636EB26}.exe

Filesize
168KB

MD5
39d5be66b078d522ea23288df4252bf9

SHA1
3ab05d4ff8acd15460167bf11b2098c2a72123c9

SHA256
32afee4eaa4a7d77408b8c5de2845f4b736bebdf001952b2c4085e385a5dfd21

SHA512
2dd43c6206407e963662b0d689af22e3c9e37d09b9158504885c65b72cf82b62ba94b0f97efb3ef596e2023d14d83dd29e2698f5d685cbda54e887f7e77da979

Download Submit
C:\Windows\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe

Filesize
168KB

MD5
7405e646195365b153176e4a12084727

SHA1
b7807633c2609a7e8d86014273fedf771fb0fe26

SHA256
dca365b67731eb3801df2969d0f6fe941cf6ea510cea1e740c07d372234b420f

SHA512
eda1f86dd20f99d08d61f8264af22acab41f12904b122a3181beffeccc6661c2af020b8de4cbae7962446ad8aca6d60770723bf3de996f73a3acf51c62dbd488

Download Submit
C:\Windows\{AFFEC5A0-D402-4cae-850B-78531712176B}.exe

Filesize
168KB

MD5
7405e646195365b153176e4a12084727

SHA1
b7807633c2609a7e8d86014273fedf771fb0fe26

SHA256
dca365b67731eb3801df2969d0f6fe941cf6ea510cea1e740c07d372234b420f

SHA512
eda1f86dd20f99d08d61f8264af22acab41f12904b122a3181beffeccc6661c2af020b8de4cbae7962446ad8aca6d60770723bf3de996f73a3acf51c62dbd488

Download Submit
C:\Windows\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe

Filesize
168KB

MD5
6e28acb87b592a33892f084cf2c0a9c0

SHA1
435acae5682a5d2984690e42d19d39ebad00b845

SHA256
f02df695df4b0b720a04208dec7957d7898126d2acdb65f2c98391f0dc837c7b

SHA512
694c2ee99bca907fee2e68cb07f4d22c9e04a5578bb1d9a7b476196414ffd769c9ed7c6a1328ad6c1fdf0898f36e20c8b064b7fb1d7ed06091d07c84bed1c345

Download Submit
C:\Windows\{B9021FF5-27E0-48d3-8567-3BD1AA476E78}.exe

Filesize
168KB

MD5
6e28acb87b592a33892f084cf2c0a9c0

SHA1
435acae5682a5d2984690e42d19d39ebad00b845

SHA256
f02df695df4b0b720a04208dec7957d7898126d2acdb65f2c98391f0dc837c7b

SHA512
694c2ee99bca907fee2e68cb07f4d22c9e04a5578bb1d9a7b476196414ffd769c9ed7c6a1328ad6c1fdf0898f36e20c8b064b7fb1d7ed06091d07c84bed1c345

Download Submit
C:\Windows\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe

Filesize
168KB

MD5
5cdab6f8beb48bd8a8cd68ef6a37e11f

SHA1
36e0df13abe6fd92cd6eea7c9d9ad76a11cf6e98

SHA256
7e5d67a4d51ced9e2bbb1a4ae94f55afba20925084c0849c5f3074dd558024bf

SHA512
1b1146851e6f0ff359e99dc6b15b14152b4b603967a1212bd5e469cfcd1894b32fa5f314a4ad737d122d9629ab803f827b5a5ff3cf3a9d2bb520913ad7d6c556

Download Submit
C:\Windows\{C05EC2FF-326D-49dc-898C-9EFFBC6ACE4D}.exe

Filesize
168KB

MD5
5cdab6f8beb48bd8a8cd68ef6a37e11f

SHA1
36e0df13abe6fd92cd6eea7c9d9ad76a11cf6e98

SHA256
7e5d67a4d51ced9e2bbb1a4ae94f55afba20925084c0849c5f3074dd558024bf

SHA512
1b1146851e6f0ff359e99dc6b15b14152b4b603967a1212bd5e469cfcd1894b32fa5f314a4ad737d122d9629ab803f827b5a5ff3cf3a9d2bb520913ad7d6c556

Download Submit
C:\Windows\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe

Filesize
168KB

MD5
afc02b6e6d284f741b3ecb3a024042f5

SHA1
51d307b56440e2a64f27ec3efae9749f235745a6

SHA256
bc11d8248c2131befd5324fd83b2b3a25c1859a13056c54b3e50b7bba35c892b

SHA512
3981b81d81c5d7c3602211c9e5536981404fe975ba0f230c6d658fd726bcee19552f3b8186bb7bd7487da1b0fe65826c30a95adbb44a2410b93f75b004fce551

Download Submit
C:\Windows\{C120CC2E-A8F8-47ce-94CB-0F93A4A031E6}.exe

Filesize
168KB

MD5
afc02b6e6d284f741b3ecb3a024042f5

SHA1
51d307b56440e2a64f27ec3efae9749f235745a6

SHA256
bc11d8248c2131befd5324fd83b2b3a25c1859a13056c54b3e50b7bba35c892b

SHA512
3981b81d81c5d7c3602211c9e5536981404fe975ba0f230c6d658fd726bcee19552f3b8186bb7bd7487da1b0fe65826c30a95adbb44a2410b93f75b004fce551

Download Submit
C:\Windows\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe

Filesize
168KB

MD5
2fa7cb7c5e86ae36236aebea24cd555c

SHA1
a1ccad3de7779a9fad7f8b76d1d754e1bfb190c6

SHA256
7c581b06ac602f2de5c3da22d3d3a525efb4ddd71aa60b60d5da2c1bc24d9dec

SHA512
8694cff0da9eeff14cc03fd49b9e379e9f4bdeae87ea78965ab45ddcfd02b36bcaedd9a23899c0337de9a3f9321a5dce3d590ca2f6bcd2a4fa8f32a905d8d6a9

Download Submit
C:\Windows\{C804CD71-86B5-4bca-A6E4-26D145325A3D}.exe

Filesize
168KB

MD5
2fa7cb7c5e86ae36236aebea24cd555c

SHA1
a1ccad3de7779a9fad7f8b76d1d754e1bfb190c6

SHA256
7c581b06ac602f2de5c3da22d3d3a525efb4ddd71aa60b60d5da2c1bc24d9dec

SHA512
8694cff0da9eeff14cc03fd49b9e379e9f4bdeae87ea78965ab45ddcfd02b36bcaedd9a23899c0337de9a3f9321a5dce3d590ca2f6bcd2a4fa8f32a905d8d6a9

Download Submit
C:\Windows\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe

Filesize
168KB

MD5
98c7cac12464edf87b1905d8015a6f55

SHA1
ed803ac88f1bad97b0c887293b417dd734fb8480

SHA256
96c0a9e3d30d30ee1231a08b91f53aee089558654fd1087b8397cd62317c8c39

SHA512
f463e3245f59115b495ae4820c394fdbf1d81b8405e8bd902683b225d1179f2946698ee71226d85d777bde335a9b50e723574f459f0a97ce0e4bbe3385c243d4

Download Submit
C:\Windows\{E2EB8B58-24E2-4329-8210-14AA836204C9}.exe

Filesize
168KB

MD5
98c7cac12464edf87b1905d8015a6f55

SHA1
ed803ac88f1bad97b0c887293b417dd734fb8480

SHA256
96c0a9e3d30d30ee1231a08b91f53aee089558654fd1087b8397cd62317c8c39

SHA512
f463e3245f59115b495ae4820c394fdbf1d81b8405e8bd902683b225d1179f2946698ee71226d85d777bde335a9b50e723574f459f0a97ce0e4bbe3385c243d4

Download Submit
C:\Windows\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe

Filesize
168KB

MD5
6eb8f8a674bace6247f373069f21d41f

SHA1
ca31d4280f88aa425229fe83a8a93230671a303f

SHA256
d9dd92ae0c6586040fa838bd814be8d09ca5a1f8145ac8665430817d08a4be52

SHA512
12f5305bf7c0e19d55de277d127565586191dbbb4c880f729cffaa3a6b53ab6effd3abe31c73605be7b42374f932964a51153b0359b74cd6c03531488795804b

Download Submit
C:\Windows\{E7E7C587-50A0-46f1-8F40-462739FAA551}.exe

Filesize
168KB

MD5
6eb8f8a674bace6247f373069f21d41f

SHA1
ca31d4280f88aa425229fe83a8a93230671a303f

SHA256
d9dd92ae0c6586040fa838bd814be8d09ca5a1f8145ac8665430817d08a4be52

SHA512
12f5305bf7c0e19d55de277d127565586191dbbb4c880f729cffaa3a6b53ab6effd3abe31c73605be7b42374f932964a51153b0359b74cd6c03531488795804b

Download Submit
C:\Windows\{FCC92091-701D-470e-9613-FFD7CD31919A}.exe

Filesize
168KB

MD5
f2c1b60656c07f5d7b69e0c2447cc0cd

SHA1
ef2c8d7829330209601f452728c2eee8875f3c42

SHA256
2e91a96e865af922cc2cbc24d2d3ce81bd79119c0cdf2a302795d263909cb51e

SHA512
08534f0be12f70df4311bd59efdd8bf2009776f878abe3c264356d7a53a298f96a07f225157d1f9e1f1d963af13ed11e2fee5bbb0c59549b2e4bf677266b792a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads