ad5a719f2d9803c36dcbf8c420203465ec899740b6faab17cb0f6e27e0d24d67

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
Size

216KB
MD5

2ed2041f037129158b144dd14ccd2237
SHA1

970d2faff3e2caa8c6102d4f6747180a65eeb433
SHA256

ad5a719f2d9803c36dcbf8c420203465ec899740b6faab17cb0f6e27e0d24d67
SHA512

71d8373e19f84c303c96f522e32d4276baac9aa02cd79121c57af4973335d32dc201c74f33cf232152c3f9c6aaaa534c0c57b4d36530c61b612fd8d6e4fd6fa7
SSDEEP

3072:jEGh0oEl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGqlEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}\stubpath = "C:\\Windows\\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe"	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6754D5DF-37F7-473d-966C-A14A8AD19D69}\stubpath = "C:\\Windows\\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe"	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89B5582-23B2-4169-957A-E3CF98312FAE}\stubpath = "C:\\Windows\\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe"	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DC591B5-F746-4875-9809-DEF1423AAF66}	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DC591B5-F746-4875-9809-DEF1423AAF66}\stubpath = "C:\\Windows\\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe"	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38858939-1AC5-4d90-8311-0F5AF9566886}	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{740DB61F-80B8-4c60-A195-D490FFD30972}\stubpath = "C:\\Windows\\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe"	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{243700D7-A984-4c48-93A1-538B1A73ADC0}\stubpath = "C:\\Windows\\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe"	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6754D5DF-37F7-473d-966C-A14A8AD19D69}	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}\stubpath = "C:\\Windows\\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe"	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}\stubpath = "C:\\Windows\\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe"	{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{740DB61F-80B8-4c60-A195-D490FFD30972}	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B765B5B-429F-40b7-B296-27DF070DBDA3}	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E89B5582-23B2-4169-957A-E3CF98312FAE}	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38858939-1AC5-4d90-8311-0F5AF9566886}\stubpath = "C:\\Windows\\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe"	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}\stubpath = "C:\\Windows\\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe"	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46410D14-039C-43ff-BACC-5C966F0391B4}\stubpath = "C:\\Windows\\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe"	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}	{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B765B5B-429F-40b7-B296-27DF070DBDA3}\stubpath = "C:\\Windows\\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe"	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{243700D7-A984-4c48-93A1-538B1A73ADC0}	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46410D14-039C-43ff-BACC-5C966F0391B4}	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe

Executes dropped EXE 12 IoCs

pid	Process
4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
2756	{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
4232	{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
File created	C:\Windows\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
File created	C:\Windows\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
File created	C:\Windows\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
File created	C:\Windows\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
File created	C:\Windows\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
File created	C:\Windows\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
File created	C:\Windows\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe	{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
File created	C:\Windows\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
File created	C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
File created	C:\Windows\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
File created	C:\Windows\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
Token: SeIncBasePriorityPrivilege	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
Token: SeIncBasePriorityPrivilege	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
Token: SeIncBasePriorityPrivilege	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
Token: SeIncBasePriorityPrivilege	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
Token: SeIncBasePriorityPrivilege	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
Token: SeIncBasePriorityPrivilege	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
Token: SeIncBasePriorityPrivilege	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
Token: SeIncBasePriorityPrivilege	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
Token: SeIncBasePriorityPrivilege	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
Token: SeIncBasePriorityPrivilege	5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
Token: SeIncBasePriorityPrivilege	2756	{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4588	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	96
PID 756 wrote to memory of 4588	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	96
PID 756 wrote to memory of 4588	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	96
PID 756 wrote to memory of 2608	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	97
PID 756 wrote to memory of 2608	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	97
PID 756 wrote to memory of 2608	756	NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe	97
PID 4588 wrote to memory of 3904	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	100
PID 4588 wrote to memory of 3904	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	100
PID 4588 wrote to memory of 3904	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	100
PID 4588 wrote to memory of 4336	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	101
PID 4588 wrote to memory of 4336	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	101
PID 4588 wrote to memory of 4336	4588	{38858939-1AC5-4d90-8311-0F5AF9566886}.exe	101
PID 3904 wrote to memory of 3888	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	105
PID 3904 wrote to memory of 3888	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	105
PID 3904 wrote to memory of 3888	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	105
PID 3904 wrote to memory of 2796	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	104
PID 3904 wrote to memory of 2796	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	104
PID 3904 wrote to memory of 2796	3904	{740DB61F-80B8-4c60-A195-D490FFD30972}.exe	104
PID 3888 wrote to memory of 4608	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	106
PID 3888 wrote to memory of 4608	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	106
PID 3888 wrote to memory of 4608	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	106
PID 3888 wrote to memory of 4864	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	107
PID 3888 wrote to memory of 4864	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	107
PID 3888 wrote to memory of 4864	3888	{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe	107
PID 4608 wrote to memory of 4428	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	108
PID 4608 wrote to memory of 4428	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	108
PID 4608 wrote to memory of 4428	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	108
PID 4608 wrote to memory of 2352	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	109
PID 4608 wrote to memory of 2352	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	109
PID 4608 wrote to memory of 2352	4608	{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe	109
PID 4428 wrote to memory of 1440	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	111
PID 4428 wrote to memory of 1440	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	111
PID 4428 wrote to memory of 1440	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	111
PID 4428 wrote to memory of 928	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	112
PID 4428 wrote to memory of 928	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	112
PID 4428 wrote to memory of 928	4428	{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe	112
PID 1440 wrote to memory of 3352	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	113
PID 1440 wrote to memory of 3352	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	113
PID 1440 wrote to memory of 3352	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	113
PID 1440 wrote to memory of 4944	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	114
PID 1440 wrote to memory of 4944	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	114
PID 1440 wrote to memory of 4944	1440	{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe	114
PID 3352 wrote to memory of 1300	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	115
PID 3352 wrote to memory of 1300	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	115
PID 3352 wrote to memory of 1300	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	115
PID 3352 wrote to memory of 4408	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	116
PID 3352 wrote to memory of 4408	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	116
PID 3352 wrote to memory of 4408	3352	{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe	116
PID 1300 wrote to memory of 4112	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	124
PID 1300 wrote to memory of 4112	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	124
PID 1300 wrote to memory of 4112	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	124
PID 1300 wrote to memory of 932	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	125
PID 1300 wrote to memory of 932	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	125
PID 1300 wrote to memory of 932	1300	{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe	125
PID 4112 wrote to memory of 5008	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	126
PID 4112 wrote to memory of 5008	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	126
PID 4112 wrote to memory of 5008	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	126
PID 4112 wrote to memory of 2936	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	127
PID 4112 wrote to memory of 2936	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	127
PID 4112 wrote to memory of 2936	4112	{46410D14-039C-43ff-BACC-5C966F0391B4}.exe	127
PID 5008 wrote to memory of 2756	5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe	128
PID 5008 wrote to memory of 2756	5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe	128
PID 5008 wrote to memory of 2756	5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe	128
PID 5008 wrote to memory of 3212	5008	{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe	129

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-09_2ed2041f037129158b144dd14ccd2237_goldeneye_JC.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
  C:\Windows\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
    C:\Windows\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{740DB~1.EXE > nul
      4⤵
      PID:2796
  - - C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
      C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Windows\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
        
        C:\Windows\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Windows\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
        
        C:\Windows\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
        
        C:\Windows\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
        
        C:\Windows\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
        
        C:\Windows\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
        
        C:\Windows\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
        
        C:\Windows\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
        
        C:\Windows\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe
        
        C:\Windows\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe
        13⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9DC59~1.EXE > nul
        13⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E89B5~1.EXE > nul
        12⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46410~1.EXE > nul
        11⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9BF6~1.EXE > nul
        10⤵
        
        PID:932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6754D~1.EXE > nul
        9⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0CBFE~1.EXE > nul
        8⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24370~1.EXE > nul
        7⤵
        
        PID:928
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5B765~1.EXE > nul
        6⤵
        
        PID:2352
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA82C~1.EXE > nul
        5⤵
        
        PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{38858~1.EXE > nul
    3⤵
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\NEAS20~1.EXE > nul
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe

Filesize
216KB

MD5
9c7b764e1c8990be6199ad1c645943f5

SHA1
5203de9288738251ab50c403fbeb52e865e666b4

SHA256
40f7121a5bd362dad839b3d4f2af5fff23f47337022876960209359fe21b7131

SHA512
dca55ac0734b45825cb7d0fc0941bfdea2bf4623ed4016154facb348ec08cac0ce4d9cceea9537756543da333d78629fa267791f9d3c13701809799d2123c2f3

Download Submit
C:\Windows\{0CBFE5B8-9F8C-46b1-9E55-124CF3C5A616}.exe

Filesize
216KB

MD5
9c7b764e1c8990be6199ad1c645943f5

SHA1
5203de9288738251ab50c403fbeb52e865e666b4

SHA256
40f7121a5bd362dad839b3d4f2af5fff23f47337022876960209359fe21b7131

SHA512
dca55ac0734b45825cb7d0fc0941bfdea2bf4623ed4016154facb348ec08cac0ce4d9cceea9537756543da333d78629fa267791f9d3c13701809799d2123c2f3

Download Submit
C:\Windows\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe

Filesize
216KB

MD5
af301601213a2c1b69feb983896267d5

SHA1
0d492cd5a449cbe1df4d01e0cca15e6d7399ed2a

SHA256
04709b20304313bc0a7070638facd977290bf491ea06d7dc1634f4c9727f379e

SHA512
2cb4ceabd870c4322469ecaf2e7628e4a88f06408e242f3109981d2be832fdc1eb9709ca876e13bd17adc146f29a55ff3017fb8ce457cf46b087ab2174de113d

Download Submit
C:\Windows\{243700D7-A984-4c48-93A1-538B1A73ADC0}.exe

Filesize
216KB

MD5
af301601213a2c1b69feb983896267d5

SHA1
0d492cd5a449cbe1df4d01e0cca15e6d7399ed2a

SHA256
04709b20304313bc0a7070638facd977290bf491ea06d7dc1634f4c9727f379e

SHA512
2cb4ceabd870c4322469ecaf2e7628e4a88f06408e242f3109981d2be832fdc1eb9709ca876e13bd17adc146f29a55ff3017fb8ce457cf46b087ab2174de113d

Download Submit
C:\Windows\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe

Filesize
216KB

MD5
6399dc4e37193b159e9880f7758079f2

SHA1
a058ba545d68f629adf0181529bd43708a9ecde1

SHA256
4d02fdaa5891b1d0a20a554d8ed5cb9bf24f2f738965572fb00ed70b619b2c1d

SHA512
e2d22a8a4ff0a137646eb493e0ecf7db1421b6be835a5ca1215830a3615bb73e85687a14fa01baf978140823afff84e090d61598228f313d1641afbca2780b0b

Download Submit
C:\Windows\{38858939-1AC5-4d90-8311-0F5AF9566886}.exe

Filesize
216KB

MD5
6399dc4e37193b159e9880f7758079f2

SHA1
a058ba545d68f629adf0181529bd43708a9ecde1

SHA256
4d02fdaa5891b1d0a20a554d8ed5cb9bf24f2f738965572fb00ed70b619b2c1d

SHA512
e2d22a8a4ff0a137646eb493e0ecf7db1421b6be835a5ca1215830a3615bb73e85687a14fa01baf978140823afff84e090d61598228f313d1641afbca2780b0b

Download Submit
C:\Windows\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe

Filesize
216KB

MD5
617c2e82513a4b2a30ef1ac3052711ae

SHA1
cddba319998b2c8d73b13a7ea6649fdaddb121f0

SHA256
9cb604fba32f994d2b29897d8454fbf45bfa434aa9b773864614dac95d7d2b9a

SHA512
cb38299425e61bc3c660b231844cc86aae02bd237471ae7367a5ea0cad8812f14825837b35e01eb8b323c827dffaac8fc19b8fbadb49178e78d5fed39f41c253

Download Submit
C:\Windows\{46410D14-039C-43ff-BACC-5C966F0391B4}.exe

Filesize
216KB

MD5
617c2e82513a4b2a30ef1ac3052711ae

SHA1
cddba319998b2c8d73b13a7ea6649fdaddb121f0

SHA256
9cb604fba32f994d2b29897d8454fbf45bfa434aa9b773864614dac95d7d2b9a

SHA512
cb38299425e61bc3c660b231844cc86aae02bd237471ae7367a5ea0cad8812f14825837b35e01eb8b323c827dffaac8fc19b8fbadb49178e78d5fed39f41c253

Download Submit
C:\Windows\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe

Filesize
216KB

MD5
e9b901c110423bd52fb4f2f8473bf1a0

SHA1
86885141be0a58206e25da6c87d6ba92daae1913

SHA256
098198933cac60d5f888d42597e70658d390881928f1c2cc75dc01db946940fb

SHA512
f3bda7453198b2a4d1db546699983324d480c6ccd0f1590bece276aafb5c9498f6412997a37cb49c31e4053782cf0b8c400d868278faac72d7ca381a1ea631d6

Download Submit
C:\Windows\{5B765B5B-429F-40b7-B296-27DF070DBDA3}.exe

Filesize
216KB

MD5
e9b901c110423bd52fb4f2f8473bf1a0

SHA1
86885141be0a58206e25da6c87d6ba92daae1913

SHA256
098198933cac60d5f888d42597e70658d390881928f1c2cc75dc01db946940fb

SHA512
f3bda7453198b2a4d1db546699983324d480c6ccd0f1590bece276aafb5c9498f6412997a37cb49c31e4053782cf0b8c400d868278faac72d7ca381a1ea631d6

Download Submit
C:\Windows\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe

Filesize
216KB

MD5
d94e4ab7688b12a3d513432293ede6b9

SHA1
874aced9cec7a4212fdd7fa11a8887c7158d5ee3

SHA256
0db55c2f49253ae3023033121050223197af31c65c49648d1c9edda301c86bb3

SHA512
0047a45ff1e1b9dda445526b0bccbf0198dd242e1e34db2eeac7c08b11467bfe29ec633951553e0290e7ebcd6742889588eb369914c79b9ea7ebeea75c08b3fe

Download Submit
C:\Windows\{6754D5DF-37F7-473d-966C-A14A8AD19D69}.exe

Filesize
216KB

MD5
d94e4ab7688b12a3d513432293ede6b9

SHA1
874aced9cec7a4212fdd7fa11a8887c7158d5ee3

SHA256
0db55c2f49253ae3023033121050223197af31c65c49648d1c9edda301c86bb3

SHA512
0047a45ff1e1b9dda445526b0bccbf0198dd242e1e34db2eeac7c08b11467bfe29ec633951553e0290e7ebcd6742889588eb369914c79b9ea7ebeea75c08b3fe

Download Submit
C:\Windows\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe

Filesize
216KB

MD5
63ccd8256cea288c9347f298ab79dc1f

SHA1
29a6091bb0cb936c67a117e9e5d7f1fab3813657

SHA256
c15be0e84dab0030dbc995034d231ffd07aca73f581a5590ad0dfec28184f3f0

SHA512
552935c9adcc0fbcac293b6192ae6313c87b830e280a765a15c00fcefc33a6afbc15b957e8ba389d9db0e30a099f096c25ee698bc3f719e628f7c34d16ca8311

Download Submit
C:\Windows\{740DB61F-80B8-4c60-A195-D490FFD30972}.exe

Filesize
216KB

MD5
63ccd8256cea288c9347f298ab79dc1f

SHA1
29a6091bb0cb936c67a117e9e5d7f1fab3813657

SHA256
c15be0e84dab0030dbc995034d231ffd07aca73f581a5590ad0dfec28184f3f0

SHA512
552935c9adcc0fbcac293b6192ae6313c87b830e280a765a15c00fcefc33a6afbc15b957e8ba389d9db0e30a099f096c25ee698bc3f719e628f7c34d16ca8311

Download Submit
C:\Windows\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe

Filesize
216KB

MD5
1ea4a314e217029e9c4d406d27ab5a98

SHA1
ef5f7450abf8f47c6275bc6d13bcb3f2f4586a9c

SHA256
be2ca5fb878751f229cd657cdccc745b1f4423cbd379ad65265b2703c25df924

SHA512
16ecde4b9c0e70c4173458b2c429378eae3e7cb029b2f73a877b583afe379fb46dc7f5292bb29efab1a1c00e42818d8a47329bd1d3380412af35dfa77ec1932d

Download Submit
C:\Windows\{9DC591B5-F746-4875-9809-DEF1423AAF66}.exe

Filesize
216KB

MD5
1ea4a314e217029e9c4d406d27ab5a98

SHA1
ef5f7450abf8f47c6275bc6d13bcb3f2f4586a9c

SHA256
be2ca5fb878751f229cd657cdccc745b1f4423cbd379ad65265b2703c25df924

SHA512
16ecde4b9c0e70c4173458b2c429378eae3e7cb029b2f73a877b583afe379fb46dc7f5292bb29efab1a1c00e42818d8a47329bd1d3380412af35dfa77ec1932d

Download Submit
C:\Windows\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe

Filesize
216KB

MD5
be310b2a659f1c77fc639076e33281ac

SHA1
8f809174321d7ee774a24048ba1d67a358d919b9

SHA256
072a5db5f50cbb22f58110b804109bbbc308ce098fa6a649ed9df92d40ee8f76

SHA512
f8fcca175647f6e97a87037a4444d382fec5047e4f843690388cdefdeb406f80e6982d268b463067d8bef8053574a82e096c72bf251d40e1af27898f99e1157e

Download Submit
C:\Windows\{B9BF62A9-345B-49c6-B110-6E1EB505A8D1}.exe

Filesize
216KB

MD5
be310b2a659f1c77fc639076e33281ac

SHA1
8f809174321d7ee774a24048ba1d67a358d919b9

SHA256
072a5db5f50cbb22f58110b804109bbbc308ce098fa6a649ed9df92d40ee8f76

SHA512
f8fcca175647f6e97a87037a4444d382fec5047e4f843690388cdefdeb406f80e6982d268b463067d8bef8053574a82e096c72bf251d40e1af27898f99e1157e

Download Submit
C:\Windows\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe

Filesize
216KB

MD5
ced564b439f3593293eddacd9f5b849d

SHA1
c88ca7602d4a56acc4a3346b1a0f818c7d21e9f6

SHA256
5152823502b22c2e34055567b9b3f861b75d43a4c0e279de2d481b3587bc7196

SHA512
774eed0fb04ea1498600fe8f84eaac366d5bcb464758b647650efb256eb53f6317a502e4645fbfd76c6558165d95fe65b9229c58142ffc580762e82d2fe12f72

Download Submit
C:\Windows\{E89B5582-23B2-4169-957A-E3CF98312FAE}.exe

Filesize
216KB

MD5
ced564b439f3593293eddacd9f5b849d

SHA1
c88ca7602d4a56acc4a3346b1a0f818c7d21e9f6

SHA256
5152823502b22c2e34055567b9b3f861b75d43a4c0e279de2d481b3587bc7196

SHA512
774eed0fb04ea1498600fe8f84eaac366d5bcb464758b647650efb256eb53f6317a502e4645fbfd76c6558165d95fe65b9229c58142ffc580762e82d2fe12f72

Download Submit
C:\Windows\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe

Filesize
216KB

MD5
46602e573fd9bc6cc96424b24eaec3d8

SHA1
1e46f690893b7da3d8de38729ce2fc53a11f84d7

SHA256
eedcb0cb5f6cddf3ff27a1bd82487368d443a5cdb5370517951903ded8936226

SHA512
29f0973927fc995a2f8fe48002ab062a87855aebd98398442a6d5181c278e79dedcb8bf86c9548263bab6e365f39c84dca4e2b734010f8cc3c9a15581c0b23f3

Download Submit
C:\Windows\{F0033C17-ED92-4b37-87FF-BB29F2E77C3D}.exe

Filesize
216KB

MD5
46602e573fd9bc6cc96424b24eaec3d8

SHA1
1e46f690893b7da3d8de38729ce2fc53a11f84d7

SHA256
eedcb0cb5f6cddf3ff27a1bd82487368d443a5cdb5370517951903ded8936226

SHA512
29f0973927fc995a2f8fe48002ab062a87855aebd98398442a6d5181c278e79dedcb8bf86c9548263bab6e365f39c84dca4e2b734010f8cc3c9a15581c0b23f3

Download Submit
C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe

Filesize
216KB

MD5
8f303c2de63dbdea54d8a199882793bf

SHA1
975bff9e3c24790177b4bcb18b2ec7d9cf1b7554

SHA256
050d4400ffc69a7cc88049bd9b4cbbf0cb1edff3f2135325e27a5e97b39f74f9

SHA512
033ee14b3e62c6e23fdca47dbe4ef4e6dbaaed45dbea07b8dae1658ce6cd3bbb4e0152bf60614a547fe80737d8569fa3a631f95bb1f63419dcc1c4c02465dd3d

Download Submit
C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe

Filesize
216KB

MD5
8f303c2de63dbdea54d8a199882793bf

SHA1
975bff9e3c24790177b4bcb18b2ec7d9cf1b7554

SHA256
050d4400ffc69a7cc88049bd9b4cbbf0cb1edff3f2135325e27a5e97b39f74f9

SHA512
033ee14b3e62c6e23fdca47dbe4ef4e6dbaaed45dbea07b8dae1658ce6cd3bbb4e0152bf60614a547fe80737d8569fa3a631f95bb1f63419dcc1c4c02465dd3d

Download Submit
C:\Windows\{FA82C9A5-A32A-4ac0-8762-2C1422AF53D1}.exe

Filesize
216KB

MD5
8f303c2de63dbdea54d8a199882793bf

SHA1
975bff9e3c24790177b4bcb18b2ec7d9cf1b7554

SHA256
050d4400ffc69a7cc88049bd9b4cbbf0cb1edff3f2135325e27a5e97b39f74f9

SHA512
033ee14b3e62c6e23fdca47dbe4ef4e6dbaaed45dbea07b8dae1658ce6cd3bbb4e0152bf60614a547fe80737d8569fa3a631f95bb1f63419dcc1c4c02465dd3d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads