4938200e569d7106411424af464e06e2ecf7a42204f6afbfb95970aa9e25fc17

Analysis

max time kernel
155s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
Size

180KB
MD5

13e6d0b934ba7e616c91b56480774ebc
SHA1

ec0e0d80b0a27d3c9217affd1d89eab72bd8f2b6
SHA256

4938200e569d7106411424af464e06e2ecf7a42204f6afbfb95970aa9e25fc17
SHA512

26d7842654e836c7c71a08d23f41cc0e3b201ff08f651dcf1d58d32104b6712f75d6e994318abb2ec0d6be6b8a2fb7ac581b9216e6ac031bf915bb854cc0097f
SSDEEP

3072:jEGh0ozlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGJl5eKcAEc

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}\stubpath = "C:\\Windows\\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe"	{208923E8-BD13-4530-876A-41123C33F17B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31CD1D2D-C336-4eeb-984B-4219749F3123}	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51F03B9C-634F-4f25-BF57-F7B3C248599E}	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7F1FEAA-0BAE-4469-966D-0A775E821514}	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}\stubpath = "C:\\Windows\\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe"	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}	{208923E8-BD13-4530-876A-41123C33F17B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}\stubpath = "C:\\Windows\\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe"	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7641C22C-0112-4c10-941E-0F20A5684438}	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51F03B9C-634F-4f25-BF57-F7B3C248599E}\stubpath = "C:\\Windows\\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe"	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7F1FEAA-0BAE-4469-966D-0A775E821514}\stubpath = "C:\\Windows\\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe"	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{006D290A-9ECA-481d-A271-A049492C6FE9}	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{006D290A-9ECA-481d-A271-A049492C6FE9}\stubpath = "C:\\Windows\\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe"	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{447A9B75-17E8-403d-9362-96A4873CC93F}\stubpath = "C:\\Windows\\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe"	{D40847CD-E476-4995-9190-BBDCD1572984}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7641C22C-0112-4c10-941E-0F20A5684438}\stubpath = "C:\\Windows\\{7641C22C-0112-4c10-941E-0F20A5684438}.exe"	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31CD1D2D-C336-4eeb-984B-4219749F3123}\stubpath = "C:\\Windows\\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe"	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}\stubpath = "C:\\Windows\\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe"	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D40847CD-E476-4995-9190-BBDCD1572984}	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D40847CD-E476-4995-9190-BBDCD1572984}\stubpath = "C:\\Windows\\{D40847CD-E476-4995-9190-BBDCD1572984}.exe"	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{447A9B75-17E8-403d-9362-96A4873CC93F}	{D40847CD-E476-4995-9190-BBDCD1572984}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{208923E8-BD13-4530-876A-41123C33F17B}	{7641C22C-0112-4c10-941E-0F20A5684438}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{208923E8-BD13-4530-876A-41123C33F17B}\stubpath = "C:\\Windows\\{208923E8-BD13-4530-876A-41123C33F17B}.exe"	{7641C22C-0112-4c10-941E-0F20A5684438}.exe

Executes dropped EXE 12 IoCs

pid	Process
2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe
4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe
3088	{208923E8-BD13-4530-876A-41123C33F17B}.exe
4348	{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
File created	C:\Windows\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
File created	C:\Windows\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
File created	C:\Windows\{7641C22C-0112-4c10-941E-0F20A5684438}.exe	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
File created	C:\Windows\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe	{208923E8-BD13-4530-876A-41123C33F17B}.exe
File created	C:\Windows\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	{D40847CD-E476-4995-9190-BBDCD1572984}.exe
File created	C:\Windows\{208923E8-BD13-4530-876A-41123C33F17B}.exe	{7641C22C-0112-4c10-941E-0F20A5684438}.exe
File created	C:\Windows\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
File created	C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
File created	C:\Windows\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
File created	C:\Windows\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
File created	C:\Windows\{D40847CD-E476-4995-9190-BBDCD1572984}.exe	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
Token: SeIncBasePriorityPrivilege	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
Token: SeIncBasePriorityPrivilege	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
Token: SeIncBasePriorityPrivilege	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
Token: SeIncBasePriorityPrivilege	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
Token: SeIncBasePriorityPrivilege	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
Token: SeIncBasePriorityPrivilege	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
Token: SeIncBasePriorityPrivilege	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe
Token: SeIncBasePriorityPrivilege	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
Token: SeIncBasePriorityPrivilege	4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe
Token: SeIncBasePriorityPrivilege	3088	{208923E8-BD13-4530-876A-41123C33F17B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2556	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	88
PID 4048 wrote to memory of 2556	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	88
PID 4048 wrote to memory of 2556	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	88
PID 4048 wrote to memory of 3340	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	89
PID 4048 wrote to memory of 3340	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	89
PID 4048 wrote to memory of 3340	4048	2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe	89
PID 2556 wrote to memory of 2116	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	92
PID 2556 wrote to memory of 2116	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	92
PID 2556 wrote to memory of 2116	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	92
PID 2556 wrote to memory of 5008	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	93
PID 2556 wrote to memory of 5008	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	93
PID 2556 wrote to memory of 5008	2556	{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe	93
PID 2116 wrote to memory of 4160	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	96
PID 2116 wrote to memory of 4160	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	96
PID 2116 wrote to memory of 4160	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	96
PID 2116 wrote to memory of 1332	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	97
PID 2116 wrote to memory of 1332	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	97
PID 2116 wrote to memory of 1332	2116	{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe	97
PID 4160 wrote to memory of 2100	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	98
PID 4160 wrote to memory of 2100	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	98
PID 4160 wrote to memory of 2100	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	98
PID 4160 wrote to memory of 808	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	99
PID 4160 wrote to memory of 808	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	99
PID 4160 wrote to memory of 808	4160	{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe	99
PID 2100 wrote to memory of 3844	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	100
PID 2100 wrote to memory of 3844	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	100
PID 2100 wrote to memory of 3844	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	100
PID 2100 wrote to memory of 3864	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	101
PID 2100 wrote to memory of 3864	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	101
PID 2100 wrote to memory of 3864	2100	{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe	101
PID 3844 wrote to memory of 3432	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	102
PID 3844 wrote to memory of 3432	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	102
PID 3844 wrote to memory of 3432	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	102
PID 3844 wrote to memory of 1660	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	103
PID 3844 wrote to memory of 1660	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	103
PID 3844 wrote to memory of 1660	3844	{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe	103
PID 3432 wrote to memory of 2668	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	104
PID 3432 wrote to memory of 2668	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	104
PID 3432 wrote to memory of 2668	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	104
PID 3432 wrote to memory of 3108	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	105
PID 3432 wrote to memory of 3108	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	105
PID 3432 wrote to memory of 3108	3432	{006D290A-9ECA-481d-A271-A049492C6FE9}.exe	105
PID 2668 wrote to memory of 3676	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	106
PID 2668 wrote to memory of 3676	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	106
PID 2668 wrote to memory of 3676	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	106
PID 2668 wrote to memory of 3856	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	107
PID 2668 wrote to memory of 3856	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	107
PID 2668 wrote to memory of 3856	2668	{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe	107
PID 3676 wrote to memory of 4532	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	108
PID 3676 wrote to memory of 4532	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	108
PID 3676 wrote to memory of 4532	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	108
PID 3676 wrote to memory of 4272	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	109
PID 3676 wrote to memory of 4272	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	109
PID 3676 wrote to memory of 4272	3676	{D40847CD-E476-4995-9190-BBDCD1572984}.exe	109
PID 4532 wrote to memory of 4320	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	110
PID 4532 wrote to memory of 4320	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	110
PID 4532 wrote to memory of 4320	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	110
PID 4532 wrote to memory of 4116	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	111
PID 4532 wrote to memory of 4116	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	111
PID 4532 wrote to memory of 4116	4532	{447A9B75-17E8-403d-9362-96A4873CC93F}.exe	111
PID 4320 wrote to memory of 3088	4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe	112
PID 4320 wrote to memory of 3088	4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe	112
PID 4320 wrote to memory of 3088	4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe	112
PID 4320 wrote to memory of 4488	4320	{7641C22C-0112-4c10-941E-0F20A5684438}.exe	113

C:\Users\Admin\AppData\Local\Temp\2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_13e6d0b934ba7e616c91b56480774ebc_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
  C:\Windows\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
    C:\Windows\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
      C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
        
        C:\Windows\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
        
        C:\Windows\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
        
        C:\Windows\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
        
        C:\Windows\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\{D40847CD-E476-4995-9190-BBDCD1572984}.exe
        
        C:\Windows\{D40847CD-E476-4995-9190-BBDCD1572984}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
        
        C:\Windows\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\{7641C22C-0112-4c10-941E-0F20A5684438}.exe
        
        C:\Windows\{7641C22C-0112-4c10-941E-0F20A5684438}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\{208923E8-BD13-4530-876A-41123C33F17B}.exe
        
        C:\Windows\{208923E8-BD13-4530-876A-41123C33F17B}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
        
        C:\Windows\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe
        
        C:\Windows\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe
        13⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20892~1.EXE > nul
        13⤵
        
        PID:468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7641C~1.EXE > nul
        12⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{447A9~1.EXE > nul
        11⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4084~1.EXE > nul
        10⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DC9BB~1.EXE > nul
        9⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{006D2~1.EXE > nul
        8⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C1B3~1.EXE > nul
        7⤵
        
        PID:1660
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D571~1.EXE > nul
        6⤵
        
        PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F7F1F~1.EXE > nul
        5⤵
        
        PID:808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{51F03~1.EXE > nul
      4⤵
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{31CD1~1.EXE > nul
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE > nul
  2⤵
  PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe

Filesize
180KB

MD5
4d96688099bf1ddcb1438a155c0ef7e2

SHA1
02011970ca3b542b9b2c0f78cd7211a6253e99e1

SHA256
7a8189f5ef3e4d5127cd989f746bad041a2f8b2db59755a920be6a3bf47966ea

SHA512
734b3e73cf94139cba98fc13f26abc9c4b63a507ef8723929a0e80e99e7c150d41ebec14d96dfec467b2bc522d18afeb78b08793f71294b1d136a1aa2c425b7e

Download Submit
C:\Windows\{006D290A-9ECA-481d-A271-A049492C6FE9}.exe

Filesize
180KB

MD5
4d96688099bf1ddcb1438a155c0ef7e2

SHA1
02011970ca3b542b9b2c0f78cd7211a6253e99e1

SHA256
7a8189f5ef3e4d5127cd989f746bad041a2f8b2db59755a920be6a3bf47966ea

SHA512
734b3e73cf94139cba98fc13f26abc9c4b63a507ef8723929a0e80e99e7c150d41ebec14d96dfec467b2bc522d18afeb78b08793f71294b1d136a1aa2c425b7e

Download Submit
C:\Windows\{208923E8-BD13-4530-876A-41123C33F17B}.exe

Filesize
180KB

MD5
28c6811554b9f2bd7185e48285855993

SHA1
9f3a16fc39790d331312a7749de214a58bcab783

SHA256
c70be86e00f1b23fe389879318605abc30542c94047421f7db5c8644d1911b90

SHA512
fc641cd01e9e3ad6280fe5b283d967b38300f70f5e2e14056ccfb6f73546ccfa1a8656c76c3810f004328cc4989577760cef594f493025277f9f4b1efbaa4d19

Download Submit
C:\Windows\{208923E8-BD13-4530-876A-41123C33F17B}.exe

Filesize
180KB

MD5
28c6811554b9f2bd7185e48285855993

SHA1
9f3a16fc39790d331312a7749de214a58bcab783

SHA256
c70be86e00f1b23fe389879318605abc30542c94047421f7db5c8644d1911b90

SHA512
fc641cd01e9e3ad6280fe5b283d967b38300f70f5e2e14056ccfb6f73546ccfa1a8656c76c3810f004328cc4989577760cef594f493025277f9f4b1efbaa4d19

Download Submit
C:\Windows\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe

Filesize
180KB

MD5
d7b6dcfd53f395e9b443f6076f2b7b12

SHA1
68d21e826906f8a3507ec542196b3004982d1e46

SHA256
059071b91bbfab40112751ae34540e45bad41e7eb15e2f6e9577f19590b86524

SHA512
bcb56deaff8e945720e0a3b0362441fc62e5e2fb5b1f62a02b5f35179a775eac6f38f22998aae7ac7a61a79988b9c2665627803e01c4d61e35bb523ad47fe67d

Download Submit
C:\Windows\{31CD1D2D-C336-4eeb-984B-4219749F3123}.exe

Filesize
180KB

MD5
d7b6dcfd53f395e9b443f6076f2b7b12

SHA1
68d21e826906f8a3507ec542196b3004982d1e46

SHA256
059071b91bbfab40112751ae34540e45bad41e7eb15e2f6e9577f19590b86524

SHA512
bcb56deaff8e945720e0a3b0362441fc62e5e2fb5b1f62a02b5f35179a775eac6f38f22998aae7ac7a61a79988b9c2665627803e01c4d61e35bb523ad47fe67d

Download Submit
C:\Windows\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe

Filesize
180KB

MD5
3309f0dbb68efda60f5363ce914dc693

SHA1
5d131842ee0f4f6587166e1673dd5bb9628a4179

SHA256
00b8e727618eb2f0ab494541d9efc47919ffb9df8ff68124f5b799b3b4116336

SHA512
ba8c80baa9f5263d6b7c244806a7d099b42c7ff14f7a190d9fac1a98d3d0dcbcb1d032347c5c8dedf58c000e827b5c9b2ea38d1479ba86091a15d6b0f2dd4b4b

Download Submit
C:\Windows\{3D571EA6-0A4B-4620-8A61-E3DDCFAD294F}.exe

Filesize
180KB

MD5
3309f0dbb68efda60f5363ce914dc693

SHA1
5d131842ee0f4f6587166e1673dd5bb9628a4179

SHA256
00b8e727618eb2f0ab494541d9efc47919ffb9df8ff68124f5b799b3b4116336

SHA512
ba8c80baa9f5263d6b7c244806a7d099b42c7ff14f7a190d9fac1a98d3d0dcbcb1d032347c5c8dedf58c000e827b5c9b2ea38d1479ba86091a15d6b0f2dd4b4b

Download Submit
C:\Windows\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe

Filesize
180KB

MD5
288520fabf95e6c49064127b445e23f3

SHA1
c31137339880584d8ea4e996491cfcdd27d4f844

SHA256
0a28168778874611fc9d8f81c9d13a39590664462a4847cecd0bec1f77d8d51d

SHA512
d2dc3aac5b051430ded8b89bbc037d89c141e06ce33ddf147198b25983dd6a87dbe2068a8a281a6be1838a58df25a54fdf624a02ebdff26f94f7b4eb4fd2217a

Download Submit
C:\Windows\{447A9B75-17E8-403d-9362-96A4873CC93F}.exe

Filesize
180KB

MD5
288520fabf95e6c49064127b445e23f3

SHA1
c31137339880584d8ea4e996491cfcdd27d4f844

SHA256
0a28168778874611fc9d8f81c9d13a39590664462a4847cecd0bec1f77d8d51d

SHA512
d2dc3aac5b051430ded8b89bbc037d89c141e06ce33ddf147198b25983dd6a87dbe2068a8a281a6be1838a58df25a54fdf624a02ebdff26f94f7b4eb4fd2217a

Download Submit
C:\Windows\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe

Filesize
180KB

MD5
3366b70fff728e48694908ae8bbb05f6

SHA1
417aea42bc876f994c3d81766c3dc6aa94303d50

SHA256
e4c555c8ef5b4e100be1de58b7ea92266423d1f6c1e3c6dc3259ea6dba3cd9ef

SHA512
d52d88e69f4752b0f13afa1655f46ac978a9dac286d527c6796264362b215631525e57482037fc5ea582344b92886fe15e0db49d23f171f18cdfb46ff9f7a620

Download Submit
C:\Windows\{51F03B9C-634F-4f25-BF57-F7B3C248599E}.exe

Filesize
180KB

MD5
3366b70fff728e48694908ae8bbb05f6

SHA1
417aea42bc876f994c3d81766c3dc6aa94303d50

SHA256
e4c555c8ef5b4e100be1de58b7ea92266423d1f6c1e3c6dc3259ea6dba3cd9ef

SHA512
d52d88e69f4752b0f13afa1655f46ac978a9dac286d527c6796264362b215631525e57482037fc5ea582344b92886fe15e0db49d23f171f18cdfb46ff9f7a620

Download Submit
C:\Windows\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe

Filesize
180KB

MD5
4d1869d2b780fdb6aec4731cbdfc5828

SHA1
994d9f071be19525b58ce3f6d0e2fa2845fccb12

SHA256
febd10a238ff9b0e4a12b0dba6793f5f47b271ae2df27842740eb5b4dc7ad27e

SHA512
19d3ab850145504e6e7bc2d39c3e7b117c6efc8a35e582ea41e272db60417c3bfdee58be65151cce62e88234100eab2c22867fe01e0d0abee470e2d3dec0ce8c

Download Submit
C:\Windows\{5326E849-6414-4dc4-978E-0C0A5D24DCC8}.exe

Filesize
180KB

MD5
4d1869d2b780fdb6aec4731cbdfc5828

SHA1
994d9f071be19525b58ce3f6d0e2fa2845fccb12

SHA256
febd10a238ff9b0e4a12b0dba6793f5f47b271ae2df27842740eb5b4dc7ad27e

SHA512
19d3ab850145504e6e7bc2d39c3e7b117c6efc8a35e582ea41e272db60417c3bfdee58be65151cce62e88234100eab2c22867fe01e0d0abee470e2d3dec0ce8c

Download Submit
C:\Windows\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe

Filesize
180KB

MD5
0b6c091a2bba7f68e597f3f4bc70deb8

SHA1
576f77794f8f6a94c96ccbf1d5d51eb8e3cceff4

SHA256
9c7c4b2d1fbc76e3f840a596f20e37c79ccb0242bea565be6f5f8dcab2f08111

SHA512
d2cb8e6a6b5fb93d65b8ed8dde82df1dbf0f4965f4dbf8b7ef171e5cd80b278c52b783b0eeaea63546e4a65647840f60c3d6406090cc86642b0145484182a44d

Download Submit
C:\Windows\{6C1B3AA9-D0A4-4a57-B07E-0C0049C77AD2}.exe

Filesize
180KB

MD5
0b6c091a2bba7f68e597f3f4bc70deb8

SHA1
576f77794f8f6a94c96ccbf1d5d51eb8e3cceff4

SHA256
9c7c4b2d1fbc76e3f840a596f20e37c79ccb0242bea565be6f5f8dcab2f08111

SHA512
d2cb8e6a6b5fb93d65b8ed8dde82df1dbf0f4965f4dbf8b7ef171e5cd80b278c52b783b0eeaea63546e4a65647840f60c3d6406090cc86642b0145484182a44d

Download Submit
C:\Windows\{7641C22C-0112-4c10-941E-0F20A5684438}.exe

Filesize
180KB

MD5
4eb2beb3fae53be0ada3adb77d1ded1f

SHA1
82955b99884085408ef9e05e8600d93d8a537f40

SHA256
2d0850f0d0846bec7e524ea8b60327421712a3b0e749e438341e8db7a15c1b20

SHA512
05141eab66d5fdb5518936661a758892a1f61024703ab1b8d0ef25910837bb0a37db8756527ba212068bb97436a4403e775c467af4b407c5916407dc56c6f414

Download Submit
C:\Windows\{7641C22C-0112-4c10-941E-0F20A5684438}.exe

Filesize
180KB

MD5
4eb2beb3fae53be0ada3adb77d1ded1f

SHA1
82955b99884085408ef9e05e8600d93d8a537f40

SHA256
2d0850f0d0846bec7e524ea8b60327421712a3b0e749e438341e8db7a15c1b20

SHA512
05141eab66d5fdb5518936661a758892a1f61024703ab1b8d0ef25910837bb0a37db8756527ba212068bb97436a4403e775c467af4b407c5916407dc56c6f414

Download Submit
C:\Windows\{D40847CD-E476-4995-9190-BBDCD1572984}.exe

Filesize
180KB

MD5
df505ab4ae37aaecd0807c719d4007da

SHA1
ccb92ceea0750433630b3d5da2c683c3bca42643

SHA256
a6fd01c71e239f2f0f54c6896d6d5fa8e0171b7e86968634d16245ca8ac598d2

SHA512
2e30ef525b590d9d7982e2fc589ae23d38b5674fd83f5fc69618531ec6925a8ba1f4e18fd7da23cb045e140a48e1089af0782ea95568a6357d6e1381de416755

Download Submit
C:\Windows\{D40847CD-E476-4995-9190-BBDCD1572984}.exe

Filesize
180KB

MD5
df505ab4ae37aaecd0807c719d4007da

SHA1
ccb92ceea0750433630b3d5da2c683c3bca42643

SHA256
a6fd01c71e239f2f0f54c6896d6d5fa8e0171b7e86968634d16245ca8ac598d2

SHA512
2e30ef525b590d9d7982e2fc589ae23d38b5674fd83f5fc69618531ec6925a8ba1f4e18fd7da23cb045e140a48e1089af0782ea95568a6357d6e1381de416755

Download Submit
C:\Windows\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe

Filesize
180KB

MD5
c10ed1ac85500b73368105695afea283

SHA1
37ac6fe281e6e9753c2c61a78957009e05ab0072

SHA256
2615e1f8e5f9eb7b1aec2043c378a7d20d1689d602502b3a569e4377634f4e75

SHA512
908a500079124de57709f545607d1d86130ca595ebba912c805ca2d7cd6bd5223d8fa5aeedf01207ea7f9a685175a0f58b4846922fa2b6befd0bb6844845e3e7

Download Submit
C:\Windows\{DC9BB52A-A9E1-46c1-BB64-E26D9BE3CFB9}.exe

Filesize
180KB

MD5
c10ed1ac85500b73368105695afea283

SHA1
37ac6fe281e6e9753c2c61a78957009e05ab0072

SHA256
2615e1f8e5f9eb7b1aec2043c378a7d20d1689d602502b3a569e4377634f4e75

SHA512
908a500079124de57709f545607d1d86130ca595ebba912c805ca2d7cd6bd5223d8fa5aeedf01207ea7f9a685175a0f58b4846922fa2b6befd0bb6844845e3e7

Download Submit
C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe

Filesize
180KB

MD5
98b443f43d3dc70866582679a6b0cd7e

SHA1
1b9cd76ffde98003cb514e8afca5b09281fc2068

SHA256
e539ae30ca5333bffc0586935e4d8c10d53d602cdb05dd82d76244bcc1f4e84e

SHA512
ea3cb1c84e6197cb1324ae7ac825f56e78cf94645adea59338ddef982be98f3285b575d541e77da2a5c223b62d0e2757bb28b5471af13afae541cf8e0af847e0

Download Submit
C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe

Filesize
180KB

MD5
98b443f43d3dc70866582679a6b0cd7e

SHA1
1b9cd76ffde98003cb514e8afca5b09281fc2068

SHA256
e539ae30ca5333bffc0586935e4d8c10d53d602cdb05dd82d76244bcc1f4e84e

SHA512
ea3cb1c84e6197cb1324ae7ac825f56e78cf94645adea59338ddef982be98f3285b575d541e77da2a5c223b62d0e2757bb28b5471af13afae541cf8e0af847e0

Download Submit
C:\Windows\{F7F1FEAA-0BAE-4469-966D-0A775E821514}.exe

Filesize
180KB

MD5
98b443f43d3dc70866582679a6b0cd7e

SHA1
1b9cd76ffde98003cb514e8afca5b09281fc2068

SHA256
e539ae30ca5333bffc0586935e4d8c10d53d602cdb05dd82d76244bcc1f4e84e

SHA512
ea3cb1c84e6197cb1324ae7ac825f56e78cf94645adea59338ddef982be98f3285b575d541e77da2a5c223b62d0e2757bb28b5471af13afae541cf8e0af847e0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads