dcbf7c6e4662150b8d1280fb0fe64e82de0af252cbbdb5258ffa7e7564e30e23

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
Size

216KB
MD5

6707da78b129081cefdbd02819287b50
SHA1

74eb3a8a39e3c07bf5395363224b82c8211b5a13
SHA256

dcbf7c6e4662150b8d1280fb0fe64e82de0af252cbbdb5258ffa7e7564e30e23
SHA512

4857a53ce40e9123482021118b2b2428bd33f2b802c5b25e9d5c73462fa8be8dd0cb29010ca6ae82207f0365ad3252ac0ca406a5f453a5d79f408f18f6d43f9f
SSDEEP

3072:jEGh0o+l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGclEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEA5927A-3655-4d48-980A-65E721778F7B}	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B67DCAE-64A3-46a2-9669-947E85262383}\stubpath = "C:\\Windows\\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe"	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}\stubpath = "C:\\Windows\\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe"	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}\stubpath = "C:\\Windows\\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe"	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}\stubpath = "C:\\Windows\\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe"	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEA5927A-3655-4d48-980A-65E721778F7B}\stubpath = "C:\\Windows\\{BEA5927A-3655-4d48-980A-65E721778F7B}.exe"	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}\stubpath = "C:\\Windows\\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe"	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}\stubpath = "C:\\Windows\\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe"	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A47CD098-C822-4a0d-908B-F88B6DFD809E}	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A47CD098-C822-4a0d-908B-F88B6DFD809E}\stubpath = "C:\\Windows\\{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe"	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B31D9F55-3D8D-4de4-9951-430E522A3F33}\stubpath = "C:\\Windows\\{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe"	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34B12A04-BC11-4c6b-A14F-6355FD314025}	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34B12A04-BC11-4c6b-A14F-6355FD314025}\stubpath = "C:\\Windows\\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe"	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B67DCAE-64A3-46a2-9669-947E85262383}	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B31D9F55-3D8D-4de4-9951-430E522A3F33}	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}\stubpath = "C:\\Windows\\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe"	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe

Executes dropped EXE 11 IoCs

pid	Process
1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe
2616	{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
File created	C:\Windows\{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
File created	C:\Windows\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
File created	C:\Windows\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
File created	C:\Windows\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe
File created	C:\Windows\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
File created	C:\Windows\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
File created	C:\Windows\{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
File created	C:\Windows\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
File created	C:\Windows\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
File created	C:\Windows\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
Token: SeIncBasePriorityPrivilege	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
Token: SeIncBasePriorityPrivilege	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
Token: SeIncBasePriorityPrivilege	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
Token: SeIncBasePriorityPrivilege	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
Token: SeIncBasePriorityPrivilege	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
Token: SeIncBasePriorityPrivilege	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
Token: SeIncBasePriorityPrivilege	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
Token: SeIncBasePriorityPrivilege	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
Token: SeIncBasePriorityPrivilege	3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1780	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	99
PID 4784 wrote to memory of 1780	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	99
PID 4784 wrote to memory of 1780	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	99
PID 4784 wrote to memory of 1920	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	100
PID 4784 wrote to memory of 1920	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	100
PID 4784 wrote to memory of 1920	4784	2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe	100
PID 1780 wrote to memory of 3528	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	101
PID 1780 wrote to memory of 3528	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	101
PID 1780 wrote to memory of 3528	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	101
PID 1780 wrote to memory of 4368	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	102
PID 1780 wrote to memory of 4368	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	102
PID 1780 wrote to memory of 4368	1780	{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe	102
PID 3528 wrote to memory of 3976	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	107
PID 3528 wrote to memory of 3976	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	107
PID 3528 wrote to memory of 3976	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	107
PID 3528 wrote to memory of 5008	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	106
PID 3528 wrote to memory of 5008	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	106
PID 3528 wrote to memory of 5008	3528	{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe	106
PID 3976 wrote to memory of 4224	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	110
PID 3976 wrote to memory of 4224	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	110
PID 3976 wrote to memory of 4224	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	110
PID 3976 wrote to memory of 5088	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	111
PID 3976 wrote to memory of 5088	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	111
PID 3976 wrote to memory of 5088	3976	{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe	111
PID 4224 wrote to memory of 4340	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	112
PID 4224 wrote to memory of 4340	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	112
PID 4224 wrote to memory of 4340	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	112
PID 4224 wrote to memory of 1564	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	113
PID 4224 wrote to memory of 1564	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	113
PID 4224 wrote to memory of 1564	4224	{BEA5927A-3655-4d48-980A-65E721778F7B}.exe	113
PID 4340 wrote to memory of 388	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	115
PID 4340 wrote to memory of 388	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	115
PID 4340 wrote to memory of 388	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	115
PID 4340 wrote to memory of 3124	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	116
PID 4340 wrote to memory of 3124	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	116
PID 4340 wrote to memory of 3124	4340	{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe	116
PID 388 wrote to memory of 800	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	120
PID 388 wrote to memory of 800	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	120
PID 388 wrote to memory of 800	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	120
PID 388 wrote to memory of 624	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	119
PID 388 wrote to memory of 624	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	119
PID 388 wrote to memory of 624	388	{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe	119
PID 800 wrote to memory of 2512	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	126
PID 800 wrote to memory of 2512	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	126
PID 800 wrote to memory of 2512	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	126
PID 800 wrote to memory of 1588	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	125
PID 800 wrote to memory of 1588	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	125
PID 800 wrote to memory of 1588	800	{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe	125
PID 2512 wrote to memory of 4896	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	128
PID 2512 wrote to memory of 4896	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	128
PID 2512 wrote to memory of 4896	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	128
PID 2512 wrote to memory of 3076	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	127
PID 2512 wrote to memory of 3076	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	127
PID 2512 wrote to memory of 3076	2512	{4B67DCAE-64A3-46a2-9669-947E85262383}.exe	127
PID 4896 wrote to memory of 3048	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	129
PID 4896 wrote to memory of 3048	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	129
PID 4896 wrote to memory of 3048	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	129
PID 4896 wrote to memory of 1220	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	130
PID 4896 wrote to memory of 1220	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	130
PID 4896 wrote to memory of 1220	4896	{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe	130
PID 3048 wrote to memory of 2616	3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe	131
PID 3048 wrote to memory of 2616	3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe	131
PID 3048 wrote to memory of 2616	3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe	131
PID 3048 wrote to memory of 2008	3048	{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe	132

C:\Users\Admin\AppData\Local\Temp\2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_6707da78b129081cefdbd02819287b50_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
  C:\Windows\{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
    C:\Windows\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D9152~1.EXE > nul
      4⤵
      PID:5008
  - - C:\Windows\{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
      C:\Windows\{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
        
        C:\Windows\{BEA5927A-3655-4d48-980A-65E721778F7B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4224
      - C:\Windows\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
        
        C:\Windows\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
        
        C:\Windows\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EDD5C~1.EXE > nul
        8⤵
        
        PID:624
        
        C:\Windows\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
        
        C:\Windows\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{34B12~1.EXE > nul
        9⤵
        
        PID:1588
        
        C:\Windows\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
        
        C:\Windows\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4B67D~1.EXE > nul
        10⤵
        
        PID:3076
        
        C:\Windows\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
        
        C:\Windows\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe
        
        C:\Windows\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe
        
        C:\Windows\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe
        12⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D74AB~1.EXE > nul
        12⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{22FCE~1.EXE > nul
        11⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD1AA~1.EXE > nul
        7⤵
        
        PID:3124
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BEA59~1.EXE > nul
        6⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B31D9~1.EXE > nul
        5⤵
        
        PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A47CD~1.EXE > nul
    3⤵
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe

Filesize
46KB

MD5
88b08b86d5234c2560e589565c4fc9f9

SHA1
3b3668b01e3462634a1f3195f498a47aaf19ead3

SHA256
aa171c5abbc50ac038adec13d346935676d8029f03d5310456c6cdaf492fb9fc

SHA512
87ce9ad5ccd12e9277defc5128e2f246c1a7d2402ac4852ae39718a6df755765cf972908586aacb050b6ddce612abb2cc31ac61711f6577194620417a4ab33ea

Download Submit
C:\Windows\{22FCEA89-D0A3-4cb3-BF8F-757652034FC3}.exe

Filesize
53KB

MD5
e8343dddb06fc07639d52caab86116ec

SHA1
55dc6c705c7d39dfc2d71ddc6b10b5193ef11684

SHA256
72160222b816c983ef7255f5fee58468508f718e7a45a9c66414556856ee4f0d

SHA512
63b753f3e6fa52526555c2987df7ea72d209ef8bd443d1fc242079d8c0aca7cec88c4b1bd0f1e4ddf0f12e0ecb34e1eaf972d2be35f5e5f6f156e34194a388dd

Download Submit
C:\Windows\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe

Filesize
87KB

MD5
70dd8fdcc1b3eaf7a7c108f3418d1f83

SHA1
ff73ff5610742ef3461c7edeb3b00c4c8127a8ec

SHA256
9a4c7b3b5177a9bf38531f7b46c056f787cbce33df3aede20097120f8333b01f

SHA512
3aca7062b46f0743b021ca77096f5ff01ac788fbc4afdf40972a878518d53b649ba9a71ab6918a9d50d42d5d8945c10a63ff9a8f297c15196fec056b58d1f81c

Download Submit
C:\Windows\{34B12A04-BC11-4c6b-A14F-6355FD314025}.exe

Filesize
53KB

MD5
e82d5e1a63313cd618192bdae2c5113a

SHA1
214da1eb15bda358518cc787002d9354ae1a409f

SHA256
ae2bfa62a3d86ebbcd54439ab656aff675bc1b95440554b9bd8b552640e50f67

SHA512
9199665cd6e5b3388a1a357f5c82e862a31de05a890d746766bb6bec03f39d9f648c45b021360db1b8faa55e278ce1c2c47cc0b74a21886b0a75398d6b4e655c

Download Submit
C:\Windows\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe

Filesize
62KB

MD5
ea7900bb29bf8e8f8f281715f0709456

SHA1
465f9e8537a965d51a2a498e3d315d99649b75cd

SHA256
71b4cb42cf974958e956e22869647cb701decfa8d498835101f428e495258053

SHA512
59579689cc6f9b44c6cd29791b43e57eecbb1404dc20ecd7f13be841e173d13040d42be01ade22fcdf5cb1b5522e065c618faffba107973a632709622b73a264

Download Submit
C:\Windows\{4B67DCAE-64A3-46a2-9669-947E85262383}.exe

Filesize
133KB

MD5
bbbf0fb293e5d591a534244830794446

SHA1
7df72c57a5b07efb7e2ec5a42e815272eacb3020

SHA256
5d70a862c8e48f726f251a74fb7ac07186c5aa16d6ac7b4c347c49ee61e4f6bc

SHA512
8abb445955de7331124943e45f82e1ad656f71c1e136dc0060e8fe51e987bc5d14949c81363ec40afd7a05cd1b94947f99d164ea7764c1f84e98294abd5e448a

Download Submit
C:\Windows\{A47CD098-C822-4a0d-908B-F88B6DFD809E}.exe

Filesize
216KB

MD5
d470b72b7ddde07d56cc449c6c9820a8

SHA1
0ff8d209fc127b563d452feea754099f443ee8c5

SHA256
f3d17a91fcdb2920dad263e7fc44610d068ac2cb3896df0e9095139c1f811e3a

SHA512
9cfba02ab5c1d432c48ae60e039ff90b0ed115957c0aeea504702d53c30d2c8a7ab392fc1cdc64dbfcb3d605a1bf55a8069968d78cbb0000e78becef08003853

Download Submit
C:\Windows\{B31D9F55-3D8D-4de4-9951-430E522A3F33}.exe

Filesize
216KB

MD5
b8a95f11a6bcd4069c29149964851e26

SHA1
324e2df595e61a422a4d8f6a029864397ff0acd5

SHA256
6ba46bc5053d18cfeaf1fca2b9914ffc9ff51e01da4cf1ab8bd5aeab7f5fcf9d

SHA512
e21d527aebccaa14ef1dcced21855acaf4d7a3637d5136803bc76c8528ab6a01fd86d56ed56860cee0f972f1febbd0f971dc11aea9ef420c64dcf3feaa343dd9

Download Submit
C:\Windows\{BEA5927A-3655-4d48-980A-65E721778F7B}.exe

Filesize
216KB

MD5
273d9a95baf6a7d1d6e7ea9ad13435d9

SHA1
33822697d0a73737d5b9079e97610e2e2fb9d6cb

SHA256
0b95c59baf965bbc220842cf9b9f660abb490d78283298fa0e5ed7a8b5409054

SHA512
06e85c278a36feec3d4fd4b59da111f18eba6e0eb0bf87bb40c0a1d9deea60508a6d836eb4f718d2b675b13ae023f11d0db8541a86e6b64ba35158e249173dac

Download Submit
C:\Windows\{CD1AAAE8-63C0-4f76-9A99-765C46EE40C0}.exe

Filesize
216KB

MD5
c9e47d6140a5bd9f6d29a95b7b7c3d4f

SHA1
41328c40e3bc1c1647eb2939ec2f310c1c2f31a7

SHA256
7c8b16e827c405eaffc96c439b77d91fed2fe3684af77d4d60a85ed2b6b28f37

SHA512
7e7202ff588d163ff9cbbbb42df781ea2073ed55538b4698f9303acf3231ca3f9c64137f664b879f84baf6e262da5c8a2db8186eaeef50d8dd5db44ea744d497

Download Submit
C:\Windows\{D20CDD4C-59C7-4995-AA99-F213FAEDDBA5}.exe

Filesize
216KB

MD5
6b7968b9bdbc772b35639e00ff0f5422

SHA1
b357dd9b1082c753119f20bcc40d016f693991b8

SHA256
c5fbcd526ab63d55cd7545164a315bdea01357234ba714b8ca0b7d7ca231c3a5

SHA512
337bbcc59b52d84d0e00848cde8e729fadef4661753490594f601ff2ba5e8a250e4cccd732ee2288d1fe73ba6dde79850bab4325f008abf282b37fd2ae3bb0ca

Download Submit
C:\Windows\{D74AB456-A9F1-4ab1-BD1B-BFC2AFB2E450}.exe

Filesize
216KB

MD5
0dee5a0275fbccf7552ceb54a8ede988

SHA1
23b65f05e4360445696b93342e455c937ab76155

SHA256
d4003827b23e6f372ecdc40ce2e7f44d226c4044baf2857b7f796a605073d0b1

SHA512
4c2d5a1f5c1fb46a16897137064ed10639a30a6109a6ab928e44ad9b08fbac63b51c89b0f724a036628efc06cac3decb84c19134f6d30f95d91acaaf6deeb180

Download Submit
C:\Windows\{D91523CC-46CA-4e2f-92A9-0514DF6C899F}.exe

Filesize
216KB

MD5
e62a50590819253d722c7625c88372df

SHA1
df213c7747ec0342f4c7fe17db1d71cf8ee78bd4

SHA256
dda174f216d94a94b880ddaca434b3dce4f33ac0b0ad10a6630ffe7ddbfd04bc

SHA512
f611a06d6dbbe439cf103cdbf221068039f36edc590b1eb093c0721bdb78ee30332c14218886e582d8d83a55595ad95cdaf13cb5ac25902c4118617d533755db

Download Submit
C:\Windows\{EDD5CD71-47BC-4a59-9665-05297CCB2AAD}.exe

Filesize
216KB

MD5
81e1b329235afe226fba7a31588ecf3b

SHA1
9e37774d9b44a92ab0c5a9294cb5bb4e4a394bfe

SHA256
e4b67b8bb825e99a5fc8537352b564fffeb9d8d84f896e7d0610b7de4c69598b

SHA512
e88183ba1e56f7e62205d9f722d79a1e0b059d947108394e7e6b5abf29b084cbd8dae60e313d684d467df488d7af3c76a808df1602fdb7a0615d3f502d66bbf4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads