b7925660e81ac2190787eb5314124a129d062e845af766d942a552f023205976

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
Size

216KB
MD5

3d2030bc9a294747723e058da9f4b813
SHA1

f1aec093d3c2949bd92489f4a4ea0a99209f22b4
SHA256

b7925660e81ac2190787eb5314124a129d062e845af766d942a552f023205976
SHA512

f643c2983cf30bafc26b628e48b7e4d963ee4be3b51f811b232dc1fd46bd1b82da4f6eb0c572152c9d7e7ea0aa12f071e93c023fe3be23adbdc98f61d192a52b
SSDEEP

3072:jEGh0ohl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGPlEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0F50634-A5A3-4963-AE03-6A14DCA15096}	{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}\stubpath = "C:\\Windows\\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe"	{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00DFED64-896F-4ee5-8199-678902E76F06}	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204C32B6-509B-4972-ABFB-56B4683D064A}	{00DFED64-896F-4ee5-8199-678902E76F06}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204C32B6-509B-4972-ABFB-56B4683D064A}\stubpath = "C:\\Windows\\{204C32B6-509B-4972-ABFB-56B4683D064A}.exe"	{00DFED64-896F-4ee5-8199-678902E76F06}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75E831F6-7833-42a6-BC06-4659ADA1902F}\stubpath = "C:\\Windows\\{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe"	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{335AF167-E240-4707-BAE2-E5688FA32F31}	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}\stubpath = "C:\\Windows\\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe"	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8D10C39-8736-4718-834A-D85D2615276F}	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}\stubpath = "C:\\Windows\\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe"	{A8D10C39-8736-4718-834A-D85D2615276F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2625914E-FEF7-4134-B32B-6817A09E9F4D}	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2625914E-FEF7-4134-B32B-6817A09E9F4D}\stubpath = "C:\\Windows\\{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe"	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00DFED64-896F-4ee5-8199-678902E76F06}\stubpath = "C:\\Windows\\{00DFED64-896F-4ee5-8199-678902E76F06}.exe"	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{335AF167-E240-4707-BAE2-E5688FA32F31}\stubpath = "C:\\Windows\\{335AF167-E240-4707-BAE2-E5688FA32F31}.exe"	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0F50634-A5A3-4963-AE03-6A14DCA15096}\stubpath = "C:\\Windows\\{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe"	{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}\stubpath = "C:\\Windows\\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe"	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75E831F6-7833-42a6-BC06-4659ADA1902F}	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8D10C39-8736-4718-834A-D85D2615276F}\stubpath = "C:\\Windows\\{A8D10C39-8736-4718-834A-D85D2615276F}.exe"	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}	{A8D10C39-8736-4718-834A-D85D2615276F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}	{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe

Deletes itself 1 IoCs

pid	Process
2004	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe
2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
1852	{A8D10C39-8736-4718-834A-D85D2615276F}.exe
1644	{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
1804	{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe
2036	{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
File created	C:\Windows\{A8D10C39-8736-4718-834A-D85D2615276F}.exe	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
File created	C:\Windows\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe	{A8D10C39-8736-4718-834A-D85D2615276F}.exe
File created	C:\Windows\{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe	{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
File created	C:\Windows\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe	{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe
File created	C:\Windows\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
File created	C:\Windows\{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	{00DFED64-896F-4ee5-8199-678902E76F06}.exe
File created	C:\Windows\{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
File created	C:\Windows\{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
File created	C:\Windows\{00DFED64-896F-4ee5-8199-678902E76F06}.exe	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
File created	C:\Windows\{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
Token: SeIncBasePriorityPrivilege	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
Token: SeIncBasePriorityPrivilege	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe
Token: SeIncBasePriorityPrivilege	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
Token: SeIncBasePriorityPrivilege	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
Token: SeIncBasePriorityPrivilege	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
Token: SeIncBasePriorityPrivilege	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
Token: SeIncBasePriorityPrivilege	1852	{A8D10C39-8736-4718-834A-D85D2615276F}.exe
Token: SeIncBasePriorityPrivilege	1644	{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
Token: SeIncBasePriorityPrivilege	1804	{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1680	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	28
PID 2052 wrote to memory of 1680	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	28
PID 2052 wrote to memory of 1680	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	28
PID 2052 wrote to memory of 1680	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	28
PID 2052 wrote to memory of 2004	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	29
PID 2052 wrote to memory of 2004	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	29
PID 2052 wrote to memory of 2004	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	29
PID 2052 wrote to memory of 2004	2052	2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe	29
PID 1680 wrote to memory of 2600	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	32
PID 1680 wrote to memory of 2600	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	32
PID 1680 wrote to memory of 2600	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	32
PID 1680 wrote to memory of 2600	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	32
PID 1680 wrote to memory of 2768	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	33
PID 1680 wrote to memory of 2768	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	33
PID 1680 wrote to memory of 2768	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	33
PID 1680 wrote to memory of 2768	1680	{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe	33
PID 2600 wrote to memory of 2616	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	34
PID 2600 wrote to memory of 2616	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	34
PID 2600 wrote to memory of 2616	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	34
PID 2600 wrote to memory of 2616	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	34
PID 2600 wrote to memory of 2816	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	35
PID 2600 wrote to memory of 2816	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	35
PID 2600 wrote to memory of 2816	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	35
PID 2600 wrote to memory of 2816	2600	{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe	35
PID 2616 wrote to memory of 2460	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	36
PID 2616 wrote to memory of 2460	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	36
PID 2616 wrote to memory of 2460	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	36
PID 2616 wrote to memory of 2460	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	36
PID 2616 wrote to memory of 2516	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	37
PID 2616 wrote to memory of 2516	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	37
PID 2616 wrote to memory of 2516	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	37
PID 2616 wrote to memory of 2516	2616	{00DFED64-896F-4ee5-8199-678902E76F06}.exe	37
PID 2460 wrote to memory of 2120	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	38
PID 2460 wrote to memory of 2120	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	38
PID 2460 wrote to memory of 2120	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	38
PID 2460 wrote to memory of 2120	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	38
PID 2460 wrote to memory of 568	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	39
PID 2460 wrote to memory of 568	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	39
PID 2460 wrote to memory of 568	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	39
PID 2460 wrote to memory of 568	2460	{204C32B6-509B-4972-ABFB-56B4683D064A}.exe	39
PID 2120 wrote to memory of 292	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	40
PID 2120 wrote to memory of 292	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	40
PID 2120 wrote to memory of 292	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	40
PID 2120 wrote to memory of 292	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	40
PID 2120 wrote to memory of 2756	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	41
PID 2120 wrote to memory of 2756	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	41
PID 2120 wrote to memory of 2756	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	41
PID 2120 wrote to memory of 2756	2120	{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe	41
PID 292 wrote to memory of 368	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	42
PID 292 wrote to memory of 368	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	42
PID 292 wrote to memory of 368	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	42
PID 292 wrote to memory of 368	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	42
PID 292 wrote to memory of 2408	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	43
PID 292 wrote to memory of 2408	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	43
PID 292 wrote to memory of 2408	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	43
PID 292 wrote to memory of 2408	292	{335AF167-E240-4707-BAE2-E5688FA32F31}.exe	43
PID 368 wrote to memory of 1852	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	44
PID 368 wrote to memory of 1852	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	44
PID 368 wrote to memory of 1852	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	44
PID 368 wrote to memory of 1852	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	44
PID 368 wrote to memory of 1616	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	45
PID 368 wrote to memory of 1616	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	45
PID 368 wrote to memory of 1616	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	45
PID 368 wrote to memory of 1616	368	{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_3d2030bc9a294747723e058da9f4b813_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
  C:\Windows\{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
    C:\Windows\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\{00DFED64-896F-4ee5-8199-678902E76F06}.exe
      C:\Windows\{00DFED64-896F-4ee5-8199-678902E76F06}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
        
        C:\Windows\{204C32B6-509B-4972-ABFB-56B4683D064A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
        
        C:\Windows\{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
        
        C:\Windows\{335AF167-E240-4707-BAE2-E5688FA32F31}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Windows\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
        
        C:\Windows\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\{A8D10C39-8736-4718-834A-D85D2615276F}.exe
        
        C:\Windows\{A8D10C39-8736-4718-834A-D85D2615276F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
        
        C:\Windows\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe
        
        C:\Windows\{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Windows\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe
        
        C:\Windows\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe
        12⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0F50~1.EXE > nul
        12⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A355~1.EXE > nul
        11⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8D10~1.EXE > nul
        10⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E53D4~1.EXE > nul
        9⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{335AF~1.EXE > nul
        8⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75E83~1.EXE > nul
        7⤵
        
        PID:2756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{204C3~1.EXE > nul
        6⤵
        
        PID:568
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00DFE~1.EXE > nul
        5⤵
        
        PID:2516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5C742~1.EXE > nul
      4⤵
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{26259~1.EXE > nul
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00DFED64-896F-4ee5-8199-678902E76F06}.exe

Filesize
216KB

MD5
d04219f1ac75b27e81ca33a5e9e66a51

SHA1
d514c853a151d2489d5c80b7e3dda24e23e9aff7

SHA256
88c30f7e0940c9e7c3a5c58d5f42deb7d3027be2be6fe43d5e25e6c52ad84c09

SHA512
ab9eb4746b7b78c0a0da3d2c3bbb398a71574378bd0765159bbe4fe491ac2d1a27823a6be20d4d80c0d7e410e62d12684239e7ddba75a8ee3f70dd3fd37242b7

Download Submit
C:\Windows\{204C32B6-509B-4972-ABFB-56B4683D064A}.exe

Filesize
216KB

MD5
b94d72f067fd430e52a503fab5e486f4

SHA1
a4e4fe1a538674e78e1b63a99f17c13bffef179a

SHA256
d8734fa7d12e413cb282019296f3784ffa3caccf8674ec623d10117c9c98b8d2

SHA512
a036f2f7b97fdd53ede57c624bd04c585b1251d37cbe6b2a8020ac0cc41be4f96147170db2d9040ca49f76867b12c679638631ddfe6504992bec6af713d08dfd

Download Submit
C:\Windows\{2625914E-FEF7-4134-B32B-6817A09E9F4D}.exe

Filesize
216KB

MD5
9d29653cf379deb7179176610a0bcc07

SHA1
5102b8a14f20c930f39fb83a09b5a892545aafef

SHA256
812000cef4968118432e90bb5df15d768002b4f3927caa6b69d87f1af7ec5cb7

SHA512
74137be6ad402c0fbaa88d7d35e50a83d84c93fcab2aafee63127841a47f1d6912a21395020af85b31c5021d5bb14e977691d5004daa1b48e70eab8a6c758f67

Download Submit
C:\Windows\{335AF167-E240-4707-BAE2-E5688FA32F31}.exe

Filesize
216KB

MD5
769cffae0001b4f55ae684862d2a3795

SHA1
385fefb0071353fa73ca4d98c595ef127970b6cd

SHA256
0b9790a2b9b1eafd138623200bda99eb53812fb8872ee2e44aa347a5b7583d1e

SHA512
f78e741c998e35b6ff881036e01b7a6bc3191bc2ab34857cacbabcc08de4304a97359334ce3498e90a18404e00c70c769f0a2b29ff146866b76ebfac85f28981

Download Submit
C:\Windows\{3DBA825B-457F-4e47-B8C2-F61925B6D3B5}.exe

Filesize
216KB

MD5
c5693ee9c4be0a7502ef7c13d62d8418

SHA1
12faa78edbf67e4b1329e176b41f7543946fb603

SHA256
12f0d8fb6ad0680cb618a0924d085989879a152a46aacbc63637e0ba71476e7e

SHA512
97dd93c30b6f09174a155035ea1e922c3d9fab0c6f2c2e3faeb1216a2ce9f583ef9e4f6a3510f49d9e156418bd4fbd4336ee9c5bf129c3eaa74b795296a69650

Download Submit
C:\Windows\{4A355A74-1BDF-4fae-A397-859A5F08FD0F}.exe

Filesize
216KB

MD5
69e732b74e51ad8266d8c90a073733af

SHA1
b71a9c9e1bf5d911263c434736b461ce608e43e2

SHA256
c0bfb93423fec8b905f2ec0b67b1a9d50c6e5b2c225ac30f264163691cd097ec

SHA512
e036b51bc25a8032c1013902f4e1e86b7658a00b37d05ae1d10c610ee9733fd649b115c6d4059039ca693c9da4fc25961f752666bfaf695128e06308d7e3efba

Download Submit
C:\Windows\{5C742E11-A3F5-41a0-9718-1E45BA786EF0}.exe

Filesize
216KB

MD5
7935ea70f94d5bf855ff17fc09e49f3f

SHA1
1e923c80378217c68a0bc72785c20e8c78057336

SHA256
f325c5457b85274d3c83fd14162114a6289b4e1df3fc57baa4d8ae433c8966dd

SHA512
e443cc4be7baf5c77e2b79e8472614feed70576f2b0715139dc747d7a41ebded336c8a93dfb70a443c1e8539b727f91c15315b923342e371978dcd512d634aa4

Download Submit
C:\Windows\{75E831F6-7833-42a6-BC06-4659ADA1902F}.exe

Filesize
216KB

MD5
a908cb3b2c6d85966656be3427273443

SHA1
53bc39a109f4696d45d52bd53bef5c70316e7a07

SHA256
48150420666d2ff93a9b03b45ab32a8dcc9597ceebfa792ed3f58dd250bcb941

SHA512
341bd501b52764466ba659f77e1a32d1ef5c1ed7c882f9a2b4a0205c46d226fb01c50b8904d5bf2269544588dfc9da73503710f5392999aec6ff1e74eace5404

Download Submit
C:\Windows\{A8D10C39-8736-4718-834A-D85D2615276F}.exe

Filesize
216KB

MD5
2e652aaf22a995e01ac14e732c72cf2e

SHA1
9aea8a3a5b775244762e065a2a0c0f2d8fc596bd

SHA256
7131b00f8a07fadcbb4f5551c44de6f1c2e6b44543eff2e5b61ba9cc84bf2da9

SHA512
9d652a8d1b38201b605cd3f04f3c4e89da8913f653ae98daaa2f4ae5348d5639a8057a3c797f679881ff2f571e8f5531626a06b0685ccb82ec78ff61f3ed156e

Download Submit
C:\Windows\{E0F50634-A5A3-4963-AE03-6A14DCA15096}.exe

Filesize
216KB

MD5
56223d6733894fb99a026c130810174b

SHA1
99aaae47ce0c900d02ce0d53a044a047ec140dc6

SHA256
d9f39e2dcd72236c2be2daaeef6d077fd6ee415450b373bd05730c9ca2fc8e1d

SHA512
b8ea59535e0e5fc3ee98ee07741f1dbf52b0f9104536a84bf59c0050a89c27586725b5cfd5df0ce76a0eff69fb4d25dfefc19ee85de7c3f8dddd8b725e3722b3

Download Submit
C:\Windows\{E53D47BE-D3F6-4d73-9546-BBFCCCA04CA6}.exe

Filesize
216KB

MD5
0f1a7787310b142475545cd30846961c

SHA1
103bc520f649d909fe1f17b37b8ab99282df615e

SHA256
19d31bfa328e8631312568a06cca7254f44bd9d6b77cff9cd9387ac1be8d9541

SHA512
c2d9697cca70942438a08a1149e5a00b0881998dd6f719977295ef943ba8c1088db497cd524638b4ad0a181e601d38f295544550493a34d58d32af43fa58015e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads