80dbd9df3bb5289c5b468c3705855756996298ce4bbb1760a15ed189a3e7fb38

Analysis

max time kernel
156s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
Size

408KB
MD5

aef0af34175c78a47d7fe7a36d591e33
SHA1

bd17e1060482d0ce604c1cdf1abe791c0bd598c3
SHA256

80dbd9df3bb5289c5b468c3705855756996298ce4bbb1760a15ed189a3e7fb38
SHA512

5a4bfc676608b754c2c7443310361cecd50e069f45e82c4aa116f84914f0061dc4c697682ec4203e9c753d754466f6ef9463132d93e5a184244a0d9b8804e564
SSDEEP

3072:CEGh0ofl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGlldOe2MUVg3vTeKcAEciTBqr3jy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A439914-2C7B-489b-883A-617057D4630C}\stubpath = "C:\\Windows\\{0A439914-2C7B-489b-883A-617057D4630C}.exe"	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91C281A9-E631-4d60-A53A-883347BDC347}\stubpath = "C:\\Windows\\{91C281A9-E631-4d60-A53A-883347BDC347}.exe"	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}\stubpath = "C:\\Windows\\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe"	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ED952F-18F1-449b-8D1F-596DA8165D83}	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A439914-2C7B-489b-883A-617057D4630C}	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}\stubpath = "C:\\Windows\\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe"	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}	{91C281A9-E631-4d60-A53A-883347BDC347}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19ADC476-737B-447a-9EB7-98D699E445E8}\stubpath = "C:\\Windows\\{19ADC476-737B-447a-9EB7-98D699E445E8}.exe"	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CBD7012-6C66-433e-A5CB-E780E1276258}\stubpath = "C:\\Windows\\{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe"	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ED952F-18F1-449b-8D1F-596DA8165D83}\stubpath = "C:\\Windows\\{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe"	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}\stubpath = "C:\\Windows\\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe"	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91C281A9-E631-4d60-A53A-883347BDC347}	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19ADC476-737B-447a-9EB7-98D699E445E8}	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}\stubpath = "C:\\Windows\\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe"	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}\stubpath = "C:\\Windows\\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe"	{91C281A9-E631-4d60-A53A-883347BDC347}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CBD7012-6C66-433e-A5CB-E780E1276258}	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe

Executes dropped EXE 10 IoCs

pid	Process
4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe
2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe
2332	{0A439914-2C7B-489b-883A-617057D4630C}.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
File created	C:\Windows\{91C281A9-E631-4d60-A53A-883347BDC347}.exe	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
File created	C:\Windows\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	{91C281A9-E631-4d60-A53A-883347BDC347}.exe
File created	C:\Windows\{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
File created	C:\Windows\{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
File created	C:\Windows\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
File created	C:\Windows\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
File created	C:\Windows\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
File created	C:\Windows\{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
File created	C:\Windows\{0A439914-2C7B-489b-883A-617057D4630C}.exe	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
Token: SeIncBasePriorityPrivilege	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
Token: SeIncBasePriorityPrivilege	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
Token: SeIncBasePriorityPrivilege	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe
Token: SeIncBasePriorityPrivilege	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
Token: SeIncBasePriorityPrivilege	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
Token: SeIncBasePriorityPrivilege	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
Token: SeIncBasePriorityPrivilege	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
Token: SeIncBasePriorityPrivilege	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4400	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	94
PID 3012 wrote to memory of 4400	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	94
PID 3012 wrote to memory of 4400	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	94
PID 3012 wrote to memory of 1836	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	95
PID 3012 wrote to memory of 1836	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	95
PID 3012 wrote to memory of 1836	3012	2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe	95
PID 4400 wrote to memory of 2492	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	97
PID 4400 wrote to memory of 2492	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	97
PID 4400 wrote to memory of 2492	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	97
PID 4400 wrote to memory of 2556	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	98
PID 4400 wrote to memory of 2556	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	98
PID 4400 wrote to memory of 2556	4400	{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe	98
PID 2492 wrote to memory of 3048	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	104
PID 2492 wrote to memory of 3048	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	104
PID 2492 wrote to memory of 3048	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	104
PID 2492 wrote to memory of 916	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	105
PID 2492 wrote to memory of 916	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	105
PID 2492 wrote to memory of 916	2492	{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe	105
PID 3048 wrote to memory of 2092	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	108
PID 3048 wrote to memory of 2092	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	108
PID 3048 wrote to memory of 2092	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	108
PID 3048 wrote to memory of 1164	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	109
PID 3048 wrote to memory of 1164	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	109
PID 3048 wrote to memory of 1164	3048	{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe	109
PID 2092 wrote to memory of 2808	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	110
PID 2092 wrote to memory of 2808	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	110
PID 2092 wrote to memory of 2808	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	110
PID 2092 wrote to memory of 2312	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	111
PID 2092 wrote to memory of 2312	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	111
PID 2092 wrote to memory of 2312	2092	{91C281A9-E631-4d60-A53A-883347BDC347}.exe	111
PID 2808 wrote to memory of 404	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	114
PID 2808 wrote to memory of 404	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	114
PID 2808 wrote to memory of 404	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	114
PID 2808 wrote to memory of 8	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	113
PID 2808 wrote to memory of 8	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	113
PID 2808 wrote to memory of 8	2808	{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe	113
PID 404 wrote to memory of 4488	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	115
PID 404 wrote to memory of 4488	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	115
PID 404 wrote to memory of 4488	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	115
PID 404 wrote to memory of 2392	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	116
PID 404 wrote to memory of 2392	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	116
PID 404 wrote to memory of 2392	404	{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe	116
PID 4488 wrote to memory of 2104	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	120
PID 4488 wrote to memory of 2104	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	120
PID 4488 wrote to memory of 2104	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	120
PID 4488 wrote to memory of 5116	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	121
PID 4488 wrote to memory of 5116	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	121
PID 4488 wrote to memory of 5116	4488	{19ADC476-737B-447a-9EB7-98D699E445E8}.exe	121
PID 2104 wrote to memory of 5032	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	124
PID 2104 wrote to memory of 5032	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	124
PID 2104 wrote to memory of 5032	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	124
PID 2104 wrote to memory of 3572	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	125
PID 2104 wrote to memory of 3572	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	125
PID 2104 wrote to memory of 3572	2104	{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe	125
PID 5032 wrote to memory of 2332	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	126
PID 5032 wrote to memory of 2332	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	126
PID 5032 wrote to memory of 2332	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	126
PID 5032 wrote to memory of 4924	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	127
PID 5032 wrote to memory of 4924	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	127
PID 5032 wrote to memory of 4924	5032	{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe	127

C:\Users\Admin\AppData\Local\Temp\2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_aef0af34175c78a47d7fe7a36d591e33_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
  C:\Windows\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
    C:\Windows\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
      C:\Windows\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\{91C281A9-E631-4d60-A53A-883347BDC347}.exe
        
        C:\Windows\{91C281A9-E631-4d60-A53A-883347BDC347}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2092
      - C:\Windows\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
        
        C:\Windows\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A9C3~1.EXE > nul
        7⤵
        
        PID:8
        
        C:\Windows\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
        
        C:\Windows\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
        
        C:\Windows\{19ADC476-737B-447a-9EB7-98D699E445E8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
        
        C:\Windows\{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe
        
        C:\Windows\{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\{0A439914-2C7B-489b-883A-617057D4630C}.exe
        
        C:\Windows\{0A439914-2C7B-489b-883A-617057D4630C}.exe
        11⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45ED9~1.EXE > nul
        11⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0CBD7~1.EXE > nul
        10⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{19ADC~1.EXE > nul
        9⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FFCF7~1.EXE > nul
        8⤵
        
        PID:2392
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{91C28~1.EXE > nul
        6⤵
        
        PID:2312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{983B1~1.EXE > nul
        5⤵
        
        PID:1164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1C48D~1.EXE > nul
      4⤵
      PID:916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{05C08~1.EXE > nul
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05C08DEE-EC83-483c-AF47-26AEE5FE06B7}.exe

Filesize
408KB

MD5
d5057cda6f9599e721c26014483b3954

SHA1
491e58fd5f701bac73a0a985eeb2f58a8bf5fe13

SHA256
3ebd84a56b8b88a3b3182f8ddb8151466e919c0a720579ff67f1dd111b09e58d

SHA512
ff8181e7a89ca4929c88dccb28d9be2ae8788701a32011031d2f9dc07abd6fb2287513e85e8d424097d746ab3a880c1b7155e1dee3f8bf8a60cdc853658c508a

Download Submit
C:\Windows\{0A439914-2C7B-489b-883A-617057D4630C}.exe

Filesize
408KB

MD5
798e59fd8d78146465bf101b4a651936

SHA1
ca2dbff7217415042a637494d3db3caa7052080c

SHA256
3223018f05901fd1593fc6f04fb75f328eae37554d0c37dee563daccc7147b7d

SHA512
76a3d995d021348ec12ff4b6e02d6721fe7f89d62d4f3e9f7a03d445ef85501e0642aff7a84719e12593b4e4ce9b531cf3a3ba08bed90b02bd0a985ababa1368

Download Submit
C:\Windows\{0CBD7012-6C66-433e-A5CB-E780E1276258}.exe

Filesize
408KB

MD5
39b786a15271612540488f1b4835208c

SHA1
838cee160a28ddc1a6f57e930343dcd08ecd5391

SHA256
7e7c3cccdb42ebc8659c2898a51d3c595cecce55798eb8937e892d906863e76b

SHA512
c545829c00e7098a93edfdfca7554fde5f5c2d24e4db3df9e4b8258e334c279543452a3455cd260cc6a88db3dac5f6426446ef064b77e9402a8f8a8eaa17883d

Download Submit
C:\Windows\{19ADC476-737B-447a-9EB7-98D699E445E8}.exe

Filesize
408KB

MD5
a8a2bf1f612968b7399c8951d0def47c

SHA1
c6a09615230f27fde3499e68438830ef21988875

SHA256
01241fea9fdf18803e651c3ba6c1ac610a5f1c378f30b440eec3ead3c7744a6d

SHA512
4155deec2d5d905343d99af7e3b8093a2969296189c8439de93a7de1e599bf8b2b2a4941c50e63b4dc5aac0c2b074eafa06d40b9cee09603cc3abedcf8b3b48e

Download Submit
C:\Windows\{1C48D2CF-7D8B-4832-8D3B-6C15BCCB1419}.exe

Filesize
408KB

MD5
c4e4773f4349661cc0fa942e43a02445

SHA1
bf9ee2570d8c884b6aa202e04940196b618979a0

SHA256
f1b1c91c6f3270c0abff7d73284e764d0d6d8cadaafa0a67ee35852b1c497d7e

SHA512
594f5d0d6a8da02ffcd8f0fd861993b9fd0d99d8e0926bebe890bfaca10e03d982c78e7ecdbf2bbe6757a18b419b43ad6e3e8aa1de685de5b40c147d59b67cc4

Download Submit
C:\Windows\{2A9C3EF1-EF92-480c-B90C-DADCBFA43B63}.exe

Filesize
408KB

MD5
17b036f1a69800f4b6290a0e446e2dcb

SHA1
a8e24882b061802838395c5d68da362397b7a7d2

SHA256
883d469154ea087f69692d76d2e1ab2fcd393e2f79b935d7ab81a3507c4b74d9

SHA512
5dec68b5929c823dd0fa2cd5baf9d1efdfd4700b5043211954a85d4c2bdbf34ad023fbceeb05c2faf1792b3f2faacc58a2909bc0c80875880e6fbba8e26f060d

Download Submit
C:\Windows\{45ED952F-18F1-449b-8D1F-596DA8165D83}.exe

Filesize
408KB

MD5
8eb00a34d6890ca393f84aa0be44cc68

SHA1
d486eb6b9adfea61a50a566ebca3be6a8488d9e1

SHA256
b312406366757f806a103e487e094a9fe3e37eb6648d83e110e3cf70b3e05c0d

SHA512
5f954adc8f59932f85ff6474a207745a7838e4fd432fdefebd5d809bfa0b3903a84c62751ec319810f0bd03cbf275441b4700b87c95c987777c65d94384ef58e

Download Submit
C:\Windows\{91C281A9-E631-4d60-A53A-883347BDC347}.exe

Filesize
408KB

MD5
71c3f67c6f87fdc7a6e7b87c72ef44c4

SHA1
441e783a6af315194babdccf55b43bdb1241f19b

SHA256
ceef618c5ac3608570bc4580fa1a812e50dd94ed44ed4ad1495a8f9b072c73dc

SHA512
435a38c23b2b95c1fe7c08f67621e5b17ab17444ccd421478f9b86c27451b4cb68cad381d43ba25271f1b2ffe278367fef0a78f02a2690b66725f468141f9fa6

Download Submit
C:\Windows\{983B1BA8-EB4D-4f1f-A348-7266963DC22F}.exe

Filesize
408KB

MD5
11e7fdf34d31223cb016c91276d87cb7

SHA1
ae0e0d2538594964884ce6531014f2968bb929d0

SHA256
041e6c1206cb7958ebd481a7277d7e0364a841a010ca75a7213e5c25d49f46ad

SHA512
1b0f8061266d8f273168ebdee771a59e239c9034406af805f22d0ebed337af4a7203ddcfc5561ecfd382509a55bf7271011a9ff12d34835eb58d2453f476eb25

Download Submit
C:\Windows\{FFCF746E-0B7D-44e2-A50B-411DF74F2974}.exe

Filesize
408KB

MD5
36ffc3e5b74746140aef181e40653e99

SHA1
5f01c07e96b137483781e34d5060f3394f9f4e39

SHA256
b668d4974723ef4575f3206433c91f34fb7a579ac2639af8b390921c1f87cf99

SHA512
ff8070a71e4eb1baa253249456805eedee8693ea163f8b58b1937914875a0130150781bbf16959e0ef88f8528b10856abeb76e56d597bb8714b291ff66d842e6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads