6496ff44de143cdd4eee2d6e53b3b199d5ee0f4085d63b441362d16cda0f495e

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
Size

192KB
MD5

610fd0b97bfc22aba237692f9f90ea85
SHA1

458b6d6473e14b3e74128d3f3617f39309aa74b4
SHA256

6496ff44de143cdd4eee2d6e53b3b199d5ee0f4085d63b441362d16cda0f495e
SHA512

d0bb484bf5035cd83396895d7026359c82e44062e843251474de776db76015b057c71554188e2894b19774ae71f3ad0f63c53cfd6e9bd6ba81bc527317032594
SSDEEP

1536:1EGh0osl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0osl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}\stubpath = "C:\\Windows\\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe"	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}	{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A35F8BA7-B550-49c7-8857-3CA3443815C9}	{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A35F8BA7-B550-49c7-8857-3CA3443815C9}\stubpath = "C:\\Windows\\{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe"	{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}\stubpath = "C:\\Windows\\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe"	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00256D38-1776-47c4-B881-F78C973A2F0F}	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}\stubpath = "C:\\Windows\\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe"	{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}\stubpath = "C:\\Windows\\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe"	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54E900E0-AD7B-4402-A6D8-28E60864AD91}	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}\stubpath = "C:\\Windows\\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe"	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00256D38-1776-47c4-B881-F78C973A2F0F}\stubpath = "C:\\Windows\\{00256D38-1776-47c4-B881-F78C973A2F0F}.exe"	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54E900E0-AD7B-4402-A6D8-28E60864AD91}\stubpath = "C:\\Windows\\{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe"	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}\stubpath = "C:\\Windows\\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe"	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}\stubpath = "C:\\Windows\\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe"	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}\stubpath = "C:\\Windows\\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe"	{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}	{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe

Executes dropped EXE 11 IoCs

pid	Process
2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
1620	{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
1280	{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
2380	{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe
1416	{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe	{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
File created	C:\Windows\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
File created	C:\Windows\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
File created	C:\Windows\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
File created	C:\Windows\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
File created	C:\Windows\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe	{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
File created	C:\Windows\{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
File created	C:\Windows\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
File created	C:\Windows\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
File created	C:\Windows\{00256D38-1776-47c4-B881-F78C973A2F0F}.exe	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
File created	C:\Windows\{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe	{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
Token: SeIncBasePriorityPrivilege	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
Token: SeIncBasePriorityPrivilege	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
Token: SeIncBasePriorityPrivilege	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
Token: SeIncBasePriorityPrivilege	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
Token: SeIncBasePriorityPrivilege	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
Token: SeIncBasePriorityPrivilege	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
Token: SeIncBasePriorityPrivilege	1620	{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
Token: SeIncBasePriorityPrivilege	1280	{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
Token: SeIncBasePriorityPrivilege	2380	{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2140	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	28
PID 1836 wrote to memory of 2140	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	28
PID 1836 wrote to memory of 2140	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	28
PID 1836 wrote to memory of 2140	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	28
PID 1836 wrote to memory of 2696	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	29
PID 1836 wrote to memory of 2696	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	29
PID 1836 wrote to memory of 2696	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	29
PID 1836 wrote to memory of 2696	1836	2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe	29
PID 2140 wrote to memory of 2576	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	30
PID 2140 wrote to memory of 2576	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	30
PID 2140 wrote to memory of 2576	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	30
PID 2140 wrote to memory of 2576	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	30
PID 2140 wrote to memory of 2848	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	31
PID 2140 wrote to memory of 2848	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	31
PID 2140 wrote to memory of 2848	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	31
PID 2140 wrote to memory of 2848	2140	{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe	31
PID 2576 wrote to memory of 2632	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	35
PID 2576 wrote to memory of 2632	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	35
PID 2576 wrote to memory of 2632	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	35
PID 2576 wrote to memory of 2632	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	35
PID 2576 wrote to memory of 2224	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	34
PID 2576 wrote to memory of 2224	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	34
PID 2576 wrote to memory of 2224	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	34
PID 2576 wrote to memory of 2224	2576	{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe	34
PID 2632 wrote to memory of 1584	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	36
PID 2632 wrote to memory of 1584	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	36
PID 2632 wrote to memory of 1584	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	36
PID 2632 wrote to memory of 1584	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	36
PID 2632 wrote to memory of 592	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	37
PID 2632 wrote to memory of 592	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	37
PID 2632 wrote to memory of 592	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	37
PID 2632 wrote to memory of 592	2632	{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe	37
PID 1584 wrote to memory of 1588	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	38
PID 1584 wrote to memory of 1588	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	38
PID 1584 wrote to memory of 1588	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	38
PID 1584 wrote to memory of 1588	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	38
PID 1584 wrote to memory of 764	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	39
PID 1584 wrote to memory of 764	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	39
PID 1584 wrote to memory of 764	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	39
PID 1584 wrote to memory of 764	1584	{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe	39
PID 1588 wrote to memory of 2884	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	41
PID 1588 wrote to memory of 2884	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	41
PID 1588 wrote to memory of 2884	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	41
PID 1588 wrote to memory of 2884	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	41
PID 1588 wrote to memory of 2504	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	40
PID 1588 wrote to memory of 2504	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	40
PID 1588 wrote to memory of 2504	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	40
PID 1588 wrote to memory of 2504	1588	{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe	40
PID 2884 wrote to memory of 2924	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	42
PID 2884 wrote to memory of 2924	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	42
PID 2884 wrote to memory of 2924	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	42
PID 2884 wrote to memory of 2924	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	42
PID 2884 wrote to memory of 768	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	43
PID 2884 wrote to memory of 768	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	43
PID 2884 wrote to memory of 768	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	43
PID 2884 wrote to memory of 768	2884	{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe	43
PID 2924 wrote to memory of 1620	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	44
PID 2924 wrote to memory of 1620	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	44
PID 2924 wrote to memory of 1620	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	44
PID 2924 wrote to memory of 1620	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	44
PID 2924 wrote to memory of 1480	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	45
PID 2924 wrote to memory of 1480	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	45
PID 2924 wrote to memory of 1480	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	45
PID 2924 wrote to memory of 1480	2924	{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_610fd0b97bfc22aba237692f9f90ea85_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
  C:\Windows\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
    C:\Windows\{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{54E90~1.EXE > nul
      4⤵
      PID:2224
  - - C:\Windows\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
      C:\Windows\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
        
        C:\Windows\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1584
      - C:\Windows\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
        
        C:\Windows\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7F58~1.EXE > nul
        7⤵
        
        PID:2504
        
        C:\Windows\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
        
        C:\Windows\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
        
        C:\Windows\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
        
        C:\Windows\{00256D38-1776-47c4-B881-F78C973A2F0F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
        
        C:\Windows\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe
        
        C:\Windows\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Windows\{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe
        
        C:\Windows\{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe
        12⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FEED~1.EXE > nul
        12⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70254~1.EXE > nul
        11⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00256~1.EXE > nul
        10⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69ED0~1.EXE > nul
        9⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9BE1~1.EXE > nul
        8⤵
        
        PID:768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BF55~1.EXE > nul
        6⤵
        
        PID:764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95CFA~1.EXE > nul
        5⤵
        
        PID:592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{438A4~1.EXE > nul
    3⤵
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00256D38-1776-47c4-B881-F78C973A2F0F}.exe

Filesize
192KB

MD5
d71c83c750199e9005f55f0de8def508

SHA1
aa2cdcdec28f24fdb699d59e24476ee7b73b82dc

SHA256
0d3483ccdebdc67b548c76705211304c27e1156c90dfc0ecafb31c91372e37a6

SHA512
c204f555608f3c2d486499aed6b6ae3db8b0ca79fc1f3973202453d0e79b992050d6c6ebcd97fd793589084b2faf6f2b009b2a33783bc145e234ec9447990c2b

Download Submit
C:\Windows\{1FEED0CB-CCB1-4a53-9543-F8CA58517977}.exe

Filesize
192KB

MD5
0e0d1ce9907e075e75cc6d0d4e3799ef

SHA1
53e6f55d03921445198f68c6b3c7e53c2fae00df

SHA256
6309d9e5357bcb4ff240e5b9f9f9a46d3f6b712e15dabfa61efc64cb41bc38c9

SHA512
c049117d9d227d44193c12df0e4b3e3f4f700d19aef0267de8e8caf223e8511d12038f90604f054d451ed7db794feb1f546293269f3beb810998ec07395622b8

Download Submit
C:\Windows\{3BF558CC-9163-4d2d-B0A6-42BA5194C3F9}.exe

Filesize
192KB

MD5
1e22433963d593d7d09d2c5bbd73c30e

SHA1
c84ac650406812b068fce3de247648178c4d9c15

SHA256
e095a49f63212a769929303faac3ccf7cf7426cca4877e9beec323ba9cab58e7

SHA512
3dad53416d8fa3a2b8ad1161a09581b8618c89f2989ec14f1158b61c73fefe9869953a39e235c08da5d9f52b1a262f374eb24b3cbc08a45cede897d1a3b54b3e

Download Submit
C:\Windows\{438A48ED-8EB4-4349-942D-13A9EBFBEE4D}.exe

Filesize
192KB

MD5
429248eb99efe6463e5ee7021031e1ed

SHA1
8045b6e9e9f1b51bb9357f090adcfb926bf9ec0f

SHA256
423e1a31965a4fa1e39a3f0ad417ba207c7a729c7754353b87eb3acaec3beeef

SHA512
7be86ff43da74b23a4ac457778007c532cae58f41234bc0dcd1971350cea7f84b11060be63e6e54da4be2d2c73743470caf1857cea91d586a5ea54c4be61593c

Download Submit
C:\Windows\{54E900E0-AD7B-4402-A6D8-28E60864AD91}.exe

Filesize
192KB

MD5
28e5cc7753ffdcbb00c6140b19c3541b

SHA1
7e0defeff5fb9f8d1f78e1a457dc13f216e59ee4

SHA256
c59ba5fb0a0b0cdc599bdf07457d4bff1cdbae3465bc183320bc8cbed0de5f3f

SHA512
5ad5ce0465124d46c7fd924919d7b3df28113b6f3a08ae572ef289c93bec0771ded1d3434bc1a1823c39e282cfe1a020d8d923a225464b0e0b4545390f83d679

Download Submit
C:\Windows\{69ED0FFE-7631-470a-BD99-64B1F0ABE68F}.exe

Filesize
192KB

MD5
2797ecb718993516c63b4561f0e78a84

SHA1
1b92060d475002b6be5e9a74a5bff0100bfc08e5

SHA256
4c3e44e8f9f26199b2c0404836c66fa5f021568d25548c461cddb0dbbc22b37f

SHA512
8f5cb14f3e464efece097219237375792f16901090fbc909e0e93bc3e52aad48293040647bd49a72b166013546cc6a130834595fcaa46df94d23802cefeec9b6

Download Submit
C:\Windows\{702547A9-5220-48a1-A253-B9FE8F5A3DDF}.exe

Filesize
192KB

MD5
dbd01449257313c49e2d8621f9a1bf67

SHA1
cc0b7f184e9b74e1b5a3b473b744758a3fd15080

SHA256
5dbf2c6897c1fb4bedb26c5090cdd222a5ea30422bbaa934b9f605eb446cf971

SHA512
b8733137228a59b4da694e9f4e4cc698774843499409b8a502932d696f46e89750edea72492f9d75d0f9ef1fe9d3d20b984472ef4fbb106e7f73ffd4eb07ef89

Download Submit
C:\Windows\{95CFA99C-FF89-480f-BEFB-8BAD457108F0}.exe

Filesize
192KB

MD5
7a9ca840e54f45dc5e99a2d3445bcea8

SHA1
7e8cadab84f6f9d5f08e09c60c33b9f5a24555d7

SHA256
7b7b9bb81bdb0441056bcf1b198370cd388786c528bd07a4680f4b1eb3fe40f4

SHA512
2fdad372ee4707278eca8f8ccbe58e580e0f8959c6777e33e5edc97900d2effffda10d344551a094b3b17886a2f7d385db456886437564876f698fff7369cb26

Download Submit
C:\Windows\{A35F8BA7-B550-49c7-8857-3CA3443815C9}.exe

Filesize
192KB

MD5
1128948548d0a1ca678461e6d9f179ce

SHA1
ec0332ea268d6fcff5611396087abf3f6de3c567

SHA256
e486018a9b503ef99c7737d7dfccecf35047b20d4a7833fe03fe02d03b935c84

SHA512
7c6e720b68dc6f29a7ba442ef1719f213b93c7ec85abe15d69897faad98d42050030d9308cc2f3bc4213811669aef034aa6cc3cbde6b3511c5913f1a785af862

Download Submit
C:\Windows\{B7F58DCA-3490-407f-9CA7-086BCCF79E46}.exe

Filesize
192KB

MD5
f3467f76665d4d7f37b67f78a8aa5540

SHA1
a8c10ec0b4ac440726bc64392150a59d4743fd8b

SHA256
8c0f2af2cf700d0e686b0eab5785e89c3f9d8c79532b246d87941094d49e97c5

SHA512
4517b63c9b143f0a530d2e45537b2d42318cbec482cc5eeca0aa7135f88651c1f9a6c86d3d3b80b123422c277220ba047fbc267da02d731a8ed86eb6320a3944

Download Submit
C:\Windows\{F9BE1469-24DA-41e8-A1F0-36265A2F6098}.exe

Filesize
192KB

MD5
4791e2eeefc7783508e2be7a91422f6c

SHA1
2a7dd0e4fc73e534b1d3f52dd74dc6d7c3b570ae

SHA256
eefcfeb688a67d094e664664644970e8b0a0bec96d14cb7fdd8e36bf2d416ac1

SHA512
47d73f286e99bdb6f5f22ac30d6e957e403844db942394d32c5dc9955d76c0e74897295a47bd0cafa47904c718e7a821f57e0a565d1b6b44cd3b0ae284f6749a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads