491358089b38175d7ad09cdb120f04e5598bc3fbd5d7836e8735cf8aee002b17

Analysis

max time kernel
168s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
Size

168KB
MD5

3f536e06b9fcab649debde9835e259b5
SHA1

df768349bf602d5727ba029d92395b75e646cd6a
SHA256

491358089b38175d7ad09cdb120f04e5598bc3fbd5d7836e8735cf8aee002b17
SHA512

52decdd5f76b6a646a206c3a0d6a264c6084b2646f8da92c0fb0a091c15b4af6be2f4771479eec90e52b5a595b7b70a2db22ace836293749b7045aac9c96c78e
SSDEEP

1536:1EGh0oElq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oElqOPOe2MUVg3Ve+rX

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED63307F-4798-465f-BDC3-54940B3DDB09}	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}\stubpath = "C:\\Windows\\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe"	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}\stubpath = "C:\\Windows\\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe"	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}\stubpath = "C:\\Windows\\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe"	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{016BD9E4-712A-4f14-B236-58AC47803A87}\stubpath = "C:\\Windows\\{016BD9E4-712A-4f14-B236-58AC47803A87}.exe"	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}	{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED63307F-4798-465f-BDC3-54940B3DDB09}\stubpath = "C:\\Windows\\{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe"	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}\stubpath = "C:\\Windows\\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe"	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30379C3B-87EE-4370-874C-4F65C5EF6B59}\stubpath = "C:\\Windows\\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe"	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}\stubpath = "C:\\Windows\\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe"	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}\stubpath = "C:\\Windows\\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe"	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30379C3B-87EE-4370-874C-4F65C5EF6B59}	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}\stubpath = "C:\\Windows\\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe"	{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}\stubpath = "C:\\Windows\\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe"	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49A399EF-B2AB-40b0-9707-524AF83828A6}	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49A399EF-B2AB-40b0-9707-524AF83828A6}\stubpath = "C:\\Windows\\{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe"	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{016BD9E4-712A-4f14-B236-58AC47803A87}	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe

Executes dropped EXE 12 IoCs

pid	Process
3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
3016	{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
1292	{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
File created	C:\Windows\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
File created	C:\Windows\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
File created	C:\Windows\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
File created	C:\Windows\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
File created	C:\Windows\{016BD9E4-712A-4f14-B236-58AC47803A87}.exe	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
File created	C:\Windows\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe	{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
File created	C:\Windows\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
File created	C:\Windows\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
File created	C:\Windows\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
File created	C:\Windows\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
File created	C:\Windows\{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
Token: SeIncBasePriorityPrivilege	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
Token: SeIncBasePriorityPrivilege	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
Token: SeIncBasePriorityPrivilege	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
Token: SeIncBasePriorityPrivilege	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
Token: SeIncBasePriorityPrivilege	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
Token: SeIncBasePriorityPrivilege	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
Token: SeIncBasePriorityPrivilege	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
Token: SeIncBasePriorityPrivilege	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
Token: SeIncBasePriorityPrivilege	2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
Token: SeIncBasePriorityPrivilege	3016	{016BD9E4-712A-4f14-B236-58AC47803A87}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3232	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	100
PID 1412 wrote to memory of 3232	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	100
PID 1412 wrote to memory of 3232	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	100
PID 1412 wrote to memory of 8	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	101
PID 1412 wrote to memory of 8	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	101
PID 1412 wrote to memory of 8	1412	2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe	101
PID 3232 wrote to memory of 2412	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	104
PID 3232 wrote to memory of 2412	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	104
PID 3232 wrote to memory of 2412	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	104
PID 3232 wrote to memory of 2324	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	105
PID 3232 wrote to memory of 2324	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	105
PID 3232 wrote to memory of 2324	3232	{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe	105
PID 2412 wrote to memory of 4740	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	106
PID 2412 wrote to memory of 4740	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	106
PID 2412 wrote to memory of 4740	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	106
PID 2412 wrote to memory of 2088	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	107
PID 2412 wrote to memory of 2088	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	107
PID 2412 wrote to memory of 2088	2412	{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe	107
PID 4740 wrote to memory of 964	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	112
PID 4740 wrote to memory of 964	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	112
PID 4740 wrote to memory of 964	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	112
PID 4740 wrote to memory of 4844	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	113
PID 4740 wrote to memory of 4844	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	113
PID 4740 wrote to memory of 4844	4740	{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe	113
PID 964 wrote to memory of 3884	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	115
PID 964 wrote to memory of 3884	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	115
PID 964 wrote to memory of 3884	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	115
PID 964 wrote to memory of 1072	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	116
PID 964 wrote to memory of 1072	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	116
PID 964 wrote to memory of 1072	964	{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe	116
PID 3884 wrote to memory of 3500	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	119
PID 3884 wrote to memory of 3500	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	119
PID 3884 wrote to memory of 3500	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	119
PID 3884 wrote to memory of 1384	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	120
PID 3884 wrote to memory of 1384	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	120
PID 3884 wrote to memory of 1384	3884	{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe	120
PID 3500 wrote to memory of 1404	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	122
PID 3500 wrote to memory of 1404	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	122
PID 3500 wrote to memory of 1404	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	122
PID 3500 wrote to memory of 1028	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	123
PID 3500 wrote to memory of 1028	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	123
PID 3500 wrote to memory of 1028	3500	{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe	123
PID 1404 wrote to memory of 4888	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	129
PID 1404 wrote to memory of 4888	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	129
PID 1404 wrote to memory of 4888	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	129
PID 1404 wrote to memory of 4692	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	128
PID 1404 wrote to memory of 4692	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	128
PID 1404 wrote to memory of 4692	1404	{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe	128
PID 4888 wrote to memory of 1076	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	131
PID 4888 wrote to memory of 1076	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	131
PID 4888 wrote to memory of 1076	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	131
PID 4888 wrote to memory of 4316	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	130
PID 4888 wrote to memory of 4316	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	130
PID 4888 wrote to memory of 4316	4888	{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe	130
PID 1076 wrote to memory of 2772	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	132
PID 1076 wrote to memory of 2772	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	132
PID 1076 wrote to memory of 2772	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	132
PID 1076 wrote to memory of 1652	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	133
PID 1076 wrote to memory of 1652	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	133
PID 1076 wrote to memory of 1652	1076	{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe	133
PID 2772 wrote to memory of 3016	2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe	137
PID 2772 wrote to memory of 3016	2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe	137
PID 2772 wrote to memory of 3016	2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe	137
PID 2772 wrote to memory of 5044	2772	{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe	138

C:\Users\Admin\AppData\Local\Temp\2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_3f536e06b9fcab649debde9835e259b5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
  C:\Windows\{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
    C:\Windows\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
      C:\Windows\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
        
        C:\Windows\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:964
      - C:\Windows\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
        
        C:\Windows\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
        
        C:\Windows\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
        
        C:\Windows\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30379~1.EXE > nul
        9⤵
        
        PID:4692
        
        C:\Windows\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
        
        C:\Windows\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00F1D~1.EXE > nul
        10⤵
        
        PID:4316
        
        C:\Windows\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
        
        C:\Windows\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
        
        C:\Windows\{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
        
        C:\Windows\{016BD9E4-712A-4f14-B236-58AC47803A87}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
        
        C:\Windows\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe
        
        C:\Windows\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe
        13⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{016BD~1.EXE > nul
        13⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49A39~1.EXE > nul
        12⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36F2B~1.EXE > nul
        11⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F24CC~1.EXE > nul
        8⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80143~1.EXE > nul
        7⤵
        
        PID:1384
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D4218~1.EXE > nul
        6⤵
        
        PID:1072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC89B~1.EXE > nul
        5⤵
        
        PID:4844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AB12E~1.EXE > nul
      4⤵
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{ED633~1.EXE > nul
    3⤵
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe

Filesize
104KB

MD5
e1b6d2fdf5ce436b644a19d3e595404c

SHA1
661935677f52a5e379cf944528d9134776ada332

SHA256
07116acde378e5c5a5fd84dea3dbf52c2c2ddfbba5d788bb560e6fefa1912e66

SHA512
c0cf8d12ba1674b909c29ca8b4eb8c5716652cddb3b5316213af1160d1b33331dc8bc3201f6f8bdd989df3d602876c572a3e005ba84f827bba900f5ce6e6723d

Download Submit
C:\Windows\{00F1D838-9A17-425f-AF5A-5F7A91FAA340}.exe

Filesize
43KB

MD5
e36e0c83e6a885271ab3ae3d19761768

SHA1
9faf76256a531659b0d76e52be0e535adf4296be

SHA256
1de39e470874cf087a6a1648a3adc88f9d1b1947106a8dc1454e407dcc5b89cf

SHA512
1776027b10e693b5a886fc65179d4c97443d50e5a470bb74ad288454f0798596663b57c0493369e060483fe0fae7e17ecd1c1d3761f6985180e489f7bd35b771

Download Submit
C:\Windows\{016BD9E4-712A-4f14-B236-58AC47803A87}.exe

Filesize
168KB

MD5
b7be3bc92b592cdb8be38038146638d4

SHA1
fd5c8313eeb31abcfd0fa3e3c578cd4218cd95ac

SHA256
32dac714e8844b59de498e333ebc548d2558f5843a3df27e3b319944fa919110

SHA512
69274eb2895a926ec8ed880dbcfa4a92e86ef8dbe7a8223918998e105cb39bb4217c5e880696422bae23996769aba1c67e743f1eebcfabe9ffbed6db478b5177

Download Submit
C:\Windows\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe

Filesize
111KB

MD5
bf906e976c887ba2717fe9d97f4a6ca0

SHA1
15bbe0523211fb68fe18c69cdab33af4b172a0f9

SHA256
cf32207c71b2bbe009a65dc3f717098ed5272b77451fbf427f56ba739f0baa59

SHA512
2f39457de2b720de28b6911f3c10c0bad7c696bfb4d3f35127c777240d28e74c00354beac2298d1acd4e712c5fbed426bd48cccaadb28d89490bf78c99707fa7

Download Submit
C:\Windows\{30379C3B-87EE-4370-874C-4F65C5EF6B59}.exe

Filesize
16KB

MD5
0e92225d503e0168ab2f646e6d84a1d0

SHA1
594138c6718058b284e589ee7b8f87cd3a6b3b40

SHA256
4e88e8dea9983452ac1b42cee0bd2d48661581e4f671cc106421afdd7ba2b9b6

SHA512
62dea4e4c7d3d137c08c7c3143fa8e869969501293092375ec947d034a1387a92c5473ffe40a3c7fe0990a5815040896fc52c655d351da538573a9fcbd19df41

Download Submit
C:\Windows\{36F2B4BE-C0E1-4419-BE5B-C6C960DF3D37}.exe

Filesize
168KB

MD5
eab41e3f42f7af89a6e2c6609801fe77

SHA1
e46a04e8534dc98c0bb233907a66107607701742

SHA256
e4b47ce1d36d4e554b7dbf98a1145d43f8aa33c327a0fc6c9e273c790ea96bea

SHA512
f518d6e269520518999db3e4368a7db8d723755ac774071748c112160e3791003cd0f287455fec7fb475436eee4ee38330ffabc710e775abc01cadf1db632ca2

Download Submit
C:\Windows\{49A399EF-B2AB-40b0-9707-524AF83828A6}.exe

Filesize
168KB

MD5
a42b639e6f30d1a8d2e2bb7a37720cb6

SHA1
ec3b727cc0b55448bf2f246d01d1c2684cd1de3f

SHA256
fa6859300908e7eea995f70e10ccfae6448a1ca3b598c2b552edffd535c08c57

SHA512
480674c2688ea395b2e43ed8c7e0e6418d4af92a19477abe1ff107fd51981fe4045056997e22bd577fe6585ba109e255195d866b2fdef5e0412cdc955e7cae72

Download Submit
C:\Windows\{80143B47-E7AD-48ec-BA8C-0B1AA3F3FAB9}.exe

Filesize
168KB

MD5
d7f299345258e35beecfd9d9f1f04abb

SHA1
49f6689e5cc8d91f4575d8d25165cf5c769ddae1

SHA256
8d5708969e88ba008e8400e23e5024c34fbd8835a1bcdbfb3f06887c38cdea6d

SHA512
0872d48c7e0b5868176a161945a44a333ac84a270595c8200d8d014330dfda3287a92a9f1d3b2604625e42bcd697cb338df78684f7fef85d193ce5c1664efb82

Download Submit
C:\Windows\{83EBC779-AB21-4db9-BB0B-0B816D5B4990}.exe

Filesize
168KB

MD5
95c26a584d3d849ce1f6b8835f56f34b

SHA1
910a3338c2616ab5514b0f77b8a09eece8c96812

SHA256
278f9611debe10c5865a6d7ec59870d23b398dbc5acfaa5843a3148e68b4f668

SHA512
6d5eb88bc52f25d3f02a05126c54e055c66f60862eb2054a4dc59d36a1a7dec972b0ff3c32096a9cd29fe2b78910713e7b35833807e7fc31ebc6ffbf75725651

Download Submit
C:\Windows\{AB12E5DA-5A9A-4b9a-A9A9-F277233E23FF}.exe

Filesize
168KB

MD5
4b31aed4a136ec8830cf4ed5d1bbf679

SHA1
5f687895276fc8344b6cfdeba118da76ba372b7c

SHA256
652368ad22552ab8146feb26fe703af62a2a27da996217e8e09736f3cf824d33

SHA512
f8b4b7377ac7eb2ead6c5f86539092b59930facf2a7e29f2f52e59602bbcfe931f938089ccbbc76265d89c354904f272ce8609fc14a715088f09ed911327b033

Download Submit
C:\Windows\{BC89B76B-E5F5-4e23-9110-38AA217D3AD8}.exe

Filesize
168KB

MD5
5ad1846e7cc415ef65d257f44cb7ba61

SHA1
54105e93db61d12cec83c6be2ec17ff5ef8a8ad1

SHA256
dda8c98baf9cfda0564e599adcfd8d9beff7af4f1cf286b1ce2fc88c196c76dc

SHA512
f59f2c4445b51c974abe9a3621a090787d4cabdd14c4c6a3acfe6ead50e4a1c8d665dae6a1d564b3ba60eafd1c934aebbb9d0a1ef939af1c44962143ed0d6a9d

Download Submit
C:\Windows\{D4218758-FA0E-46bb-A6F1-FC2DF20C4AFF}.exe

Filesize
168KB

MD5
db72aab1a78b96308d8aee2b04d3a33e

SHA1
f30f572deceec50f69f16eddea25d9a6a210251e

SHA256
a5df3579b35862dd6bf932f654e0f9e6b7e4f4c35c92d240291c58c06657b132

SHA512
9d4ae26cda18b421a317f08a24595593fb3ebc347ac0ed4e2ba0d1d83879ed62add566e1cb0efaa0cbb97c09babb80f7216fb02a4a1975e4e374110e408c8975

Download Submit
C:\Windows\{ED63307F-4798-465f-BDC3-54940B3DDB09}.exe

Filesize
168KB

MD5
2f9804b7c392de5c0fc7e3ad65bdc222

SHA1
91d3692f8ad254bed3d1f6163184e28affc54142

SHA256
b631b66bf202a62bbd7683f89daed2824bd56f61e48fa1962918cfb68b9fee25

SHA512
6da7847696cc9aa64511e93384ce7e3e2a7338a43071cc76d5b8eadd741f24c5b3f8c33656a66e5341ab374f2c8c3324c54b88d2a6a39e9c67050221b6fd61fb

Download Submit
C:\Windows\{F24CCCCA-2A33-4c7c-9C00-E123F69E9968}.exe

Filesize
168KB

MD5
10f7042597505c82321125eee1ec943b

SHA1
ba0107a73b5686272ebc917dbd1d6c98ab48d6fb

SHA256
37a1f25f939e0df421dc150990970199d76acbdb369f50cddf2b4bb09db1fe25

SHA512
f08ea0ca7dee004f33df5c294084d779774703ca662bbdc4911e65cae3c9ce951abb2a896115c70cd5746e7f1f99af0eca40c884bc7253a3a1f4fa83e0ba1c52

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads