1c38a40040616f37e5e4110b97c39f499153a8df9b287ee5ed76fb253fb8c4bf

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
Size

408KB
MD5

dd816c40ab071fe0b14936c3bf686693
SHA1

a37e43f7b5a4e1b7c60c6513eba806bb0c386690
SHA256

1c38a40040616f37e5e4110b97c39f499153a8df9b287ee5ed76fb253fb8c4bf
SHA512

9286dac0d146a115a33a8e26d11baa83df139213cd4fc208f06292ddd8cc5be69749de4092f7b48074460e30295e135daa3460481270643298c9174ee61ce157
SSDEEP

3072:CEGh0oIl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGCldOe2MUVg3vTeKcAEciTBqr3jy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}	{2E059518-C8D2-476d-A214-5D037B986938}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D171513-864C-4093-A03F-122F4CE30710}	{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD4AA77C-5F75-40d7-AABD-97E49237459B}\stubpath = "C:\\Windows\\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe"	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB484B31-EC7E-4665-B198-B27A1BF5884E}	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{265ECC76-86A8-46d3-A578-C945D595650F}\stubpath = "C:\\Windows\\{265ECC76-86A8-46d3-A578-C945D595650F}.exe"	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}	{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}	{2D171513-864C-4093-A03F-122F4CE30710}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{265ECC76-86A8-46d3-A578-C945D595650F}	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}\stubpath = "C:\\Windows\\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe"	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}	{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E059518-C8D2-476d-A214-5D037B986938}\stubpath = "C:\\Windows\\{2E059518-C8D2-476d-A214-5D037B986938}.exe"	{265ECC76-86A8-46d3-A578-C945D595650F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}\stubpath = "C:\\Windows\\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe"	{2E059518-C8D2-476d-A214-5D037B986938}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}\stubpath = "C:\\Windows\\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe"	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD4AA77C-5F75-40d7-AABD-97E49237459B}	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB484B31-EC7E-4665-B198-B27A1BF5884E}\stubpath = "C:\\Windows\\{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe"	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E059518-C8D2-476d-A214-5D037B986938}	{265ECC76-86A8-46d3-A578-C945D595650F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}\stubpath = "C:\\Windows\\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe"	{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D171513-864C-4093-A03F-122F4CE30710}\stubpath = "C:\\Windows\\{2D171513-864C-4093-A03F-122F4CE30710}.exe"	{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}\stubpath = "C:\\Windows\\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe"	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}\stubpath = "C:\\Windows\\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe"	{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}\stubpath = "C:\\Windows\\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe"	{2D171513-864C-4093-A03F-122F4CE30710}.exe

Deletes itself 1 IoCs

pid	Process
2660	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe
2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe
1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
1484	{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
1868	{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
2324	{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
2916	{2D171513-864C-4093-A03F-122F4CE30710}.exe
2956	{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
File created	C:\Windows\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
File created	C:\Windows\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe	{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
File created	C:\Windows\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe	{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
File created	C:\Windows\{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
File created	C:\Windows\{265ECC76-86A8-46d3-A578-C945D595650F}.exe	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
File created	C:\Windows\{2E059518-C8D2-476d-A214-5D037B986938}.exe	{265ECC76-86A8-46d3-A578-C945D595650F}.exe
File created	C:\Windows\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
File created	C:\Windows\{2D171513-864C-4093-A03F-122F4CE30710}.exe	{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
File created	C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
File created	C:\Windows\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	{2E059518-C8D2-476d-A214-5D037B986938}.exe
File created	C:\Windows\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe	{2D171513-864C-4093-A03F-122F4CE30710}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
Token: SeIncBasePriorityPrivilege	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
Token: SeIncBasePriorityPrivilege	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe
Token: SeIncBasePriorityPrivilege	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe
Token: SeIncBasePriorityPrivilege	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
Token: SeIncBasePriorityPrivilege	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
Token: SeIncBasePriorityPrivilege	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
Token: SeIncBasePriorityPrivilege	1484	{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
Token: SeIncBasePriorityPrivilege	1868	{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
Token: SeIncBasePriorityPrivilege	2324	{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
Token: SeIncBasePriorityPrivilege	2916	{2D171513-864C-4093-A03F-122F4CE30710}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2188	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	28
PID 3052 wrote to memory of 2188	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	28
PID 3052 wrote to memory of 2188	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	28
PID 3052 wrote to memory of 2188	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	28
PID 3052 wrote to memory of 2660	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	29
PID 3052 wrote to memory of 2660	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	29
PID 3052 wrote to memory of 2660	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	29
PID 3052 wrote to memory of 2660	3052	2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe	29
PID 2188 wrote to memory of 2704	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	33
PID 2188 wrote to memory of 2704	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	33
PID 2188 wrote to memory of 2704	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	33
PID 2188 wrote to memory of 2704	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	33
PID 2188 wrote to memory of 2432	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	32
PID 2188 wrote to memory of 2432	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	32
PID 2188 wrote to memory of 2432	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	32
PID 2188 wrote to memory of 2432	2188	{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe	32
PID 2704 wrote to memory of 2760	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	34
PID 2704 wrote to memory of 2760	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	34
PID 2704 wrote to memory of 2760	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	34
PID 2704 wrote to memory of 2760	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	34
PID 2704 wrote to memory of 2716	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	35
PID 2704 wrote to memory of 2716	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	35
PID 2704 wrote to memory of 2716	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	35
PID 2704 wrote to memory of 2716	2704	{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe	35
PID 2760 wrote to memory of 2636	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	36
PID 2760 wrote to memory of 2636	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	36
PID 2760 wrote to memory of 2636	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	36
PID 2760 wrote to memory of 2636	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	36
PID 2760 wrote to memory of 2212	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	37
PID 2760 wrote to memory of 2212	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	37
PID 2760 wrote to memory of 2212	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	37
PID 2760 wrote to memory of 2212	2760	{265ECC76-86A8-46d3-A578-C945D595650F}.exe	37
PID 2636 wrote to memory of 1644	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	39
PID 2636 wrote to memory of 1644	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	39
PID 2636 wrote to memory of 1644	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	39
PID 2636 wrote to memory of 1644	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	39
PID 2636 wrote to memory of 2520	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	38
PID 2636 wrote to memory of 2520	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	38
PID 2636 wrote to memory of 2520	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	38
PID 2636 wrote to memory of 2520	2636	{2E059518-C8D2-476d-A214-5D037B986938}.exe	38
PID 1644 wrote to memory of 2524	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	40
PID 1644 wrote to memory of 2524	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	40
PID 1644 wrote to memory of 2524	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	40
PID 1644 wrote to memory of 2524	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	40
PID 1644 wrote to memory of 1972	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	41
PID 1644 wrote to memory of 1972	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	41
PID 1644 wrote to memory of 1972	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	41
PID 1644 wrote to memory of 1972	1644	{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe	41
PID 2524 wrote to memory of 472	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	43
PID 2524 wrote to memory of 472	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	43
PID 2524 wrote to memory of 472	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	43
PID 2524 wrote to memory of 472	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	43
PID 2524 wrote to memory of 1216	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	42
PID 2524 wrote to memory of 1216	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	42
PID 2524 wrote to memory of 1216	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	42
PID 2524 wrote to memory of 1216	2524	{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe	42
PID 472 wrote to memory of 1484	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	44
PID 472 wrote to memory of 1484	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	44
PID 472 wrote to memory of 1484	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	44
PID 472 wrote to memory of 1484	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	44
PID 472 wrote to memory of 1640	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	45
PID 472 wrote to memory of 1640	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	45
PID 472 wrote to memory of 1640	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	45
PID 472 wrote to memory of 1640	472	{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_dd816c40ab071fe0b14936c3bf686693_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
  C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BD4AA~1.EXE > nul
    3⤵
    PID:2432
- - C:\Windows\{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
    C:\Windows\{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\{265ECC76-86A8-46d3-A578-C945D595650F}.exe
      C:\Windows\{265ECC76-86A8-46d3-A578-C945D595650F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\{2E059518-C8D2-476d-A214-5D037B986938}.exe
        
        C:\Windows\{2E059518-C8D2-476d-A214-5D037B986938}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E059~1.EXE > nul
        6⤵
        
        PID:2520
      - C:\Windows\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
        
        C:\Windows\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
        
        C:\Windows\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D72C~1.EXE > nul
        8⤵
        
        PID:1216
        
        C:\Windows\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
        
        C:\Windows\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
        
        C:\Windows\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
        
        C:\Windows\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{348DF~1.EXE > nul
        11⤵
        
        PID:3060
        
        C:\Windows\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
        
        C:\Windows\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4B4C~1.EXE > nul
        12⤵
        
        PID:2248
        
        C:\Windows\{2D171513-864C-4093-A03F-122F4CE30710}.exe
        
        C:\Windows\{2D171513-864C-4093-A03F-122F4CE30710}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe
        
        C:\Windows\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe
        13⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D171~1.EXE > nul
        13⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1DC9~1.EXE > nul
        10⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B39D~1.EXE > nul
        9⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9DA6E~1.EXE > nul
        7⤵
        
        PID:1972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{265EC~1.EXE > nul
        5⤵
        
        PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AB484~1.EXE > nul
      4⤵
      PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{265ECC76-86A8-46d3-A578-C945D595650F}.exe

Filesize
408KB

MD5
94092dc9f116129adb0112dea3c6dd66

SHA1
aa853dea498b05f9c55be179fcaa3a6196db86ee

SHA256
9e00a2a0d0e14ded6e21453e2a97cbfbee819e196f20850ac2627cff1be4f247

SHA512
f885e3d77b0177e59cd67c034f371b4d084687ed0ab19e8c3830ced2619e7be6968fb5cb5226b800fbbcbe140a93052db603a28cf6c1235a34997a3c88b48ce8

Download Submit
C:\Windows\{2D171513-864C-4093-A03F-122F4CE30710}.exe

Filesize
408KB

MD5
69a7413bbb03206c69d8d446c81587a1

SHA1
c1a345fc8ae525f00303c97e3ac41cdd5183f70d

SHA256
c731ae9880acd37869441e609444b3ce772a93d5be71e93125cf3792b9425724

SHA512
3132780a2e14fc7cb1a2f088f1e6a42e1dd0c7d1b66f722b5a868f4e22c14ef1cae31c250d222d2ab1670bc52ad7ceb8ad5c539333e686a06f4bc0ff0dc4291f

Download Submit
C:\Windows\{2E059518-C8D2-476d-A214-5D037B986938}.exe

Filesize
408KB

MD5
b31f3cfc191b9456db65d41a7aef183b

SHA1
52293c3b38b3f128648208dba2ac63286cae07b7

SHA256
c5d9befd23b060031e55d4e2b879662f2304193a516c3c68087a72243a22188b

SHA512
8530ff1bc0cc0e989a8ca8e6c1f59e172c6f0ba54a68447b21c902ebf94a6f12ced2b375510d8539cd2ebd3f38880e12574221efd3fa4132d890d799fb935f1f

Download Submit
C:\Windows\{348DFE5F-3F80-40cb-9B01-F6302B344C6A}.exe

Filesize
408KB

MD5
20a2def57ac96554725b25d3c185f278

SHA1
59907054c387729701840a82aa59158f4bb04c78

SHA256
1ed8c75082740cba9fea7aabe45e795c23fa029f973749239adf91143e0c8c32

SHA512
06bf6e77108ee6d07b73462d98e301c420e78008e2a5ff592dbdb3102596089b3850dada4c659740e61794f1d919481d96cbff93aa79aa3a23f6fcbdfd5ea27b

Download Submit
C:\Windows\{6B39D748-B2D4-43bb-A09E-89DAF3295C00}.exe

Filesize
408KB

MD5
95cedf883d9575a4a28c0c51b7d0de0f

SHA1
48fa9ed49d75e3dc9326ecdf8a29a6676a963198

SHA256
173d0b2467f60562f53a081dbfbb5836f39eeb8e50bbc4cf6205956b5b4e5da3

SHA512
5fc9e7de39f02622ee45074a166984de0c178d41f75122d1d19d677ac682f94d6a67c48dfcbe90c3f882c9af0a467c0053a49ca08451e7f5c89fffa11840b5db

Download Submit
C:\Windows\{7F755222-B7D3-4ed5-83C3-4DA7C2AEDA70}.exe

Filesize
408KB

MD5
1bbe12db89af604b2053ed019e80e544

SHA1
baa52e91f0c54e290de9f249b3927395098478c1

SHA256
9960fce94ef74d792c43c6c9947ae359203c1a8e21372c97182bb8a66214f120

SHA512
7731410a9348993104c15fa8463a99970d91b4934333e72d2356a962133befa448429a53b16c7f4934def76409be306018bef94ea3f96cca3a1b0cb38cc14feb

Download Submit
C:\Windows\{8D72C364-D3BA-48cd-BA05-F5EA1D47537C}.exe

Filesize
408KB

MD5
d28eedb2b0848aced0fd5f0e24fdb081

SHA1
8baaf79946275c9b76e0e58d0e950f1cb1b4b2ca

SHA256
c86187b718ea92b132842337ff7af54f3f70aea2b4181d046f17d8afa58be1c3

SHA512
f87ce1af4aa65807b4b43beef3f866f162d7612e14478f6944534651ebb2f968a3d159afdbc7d73c2e58e3a87de86d4a61c577504f96f3badc1d77b3465e24c8

Download Submit
C:\Windows\{9DA6E640-B317-4aa2-ACDA-3159CE5B60E5}.exe

Filesize
408KB

MD5
55c866301fffeaefcaa8ce3f59b49c16

SHA1
e9872da1e2b9af230ac720bc953d255586805473

SHA256
18ebb71b20b5d770d005f70048bceb92c1a9eb36d4e11216cb2739528d91e8b5

SHA512
8ebc9673c73adb5416c22ca0a5d904aeeafaeaacba403d1cfe7fb04337cfe004ed41b6121bb167b20dc7f5ecaef84a1f3c3ac55a6f85a4fe825368a5d22fca59

Download Submit
C:\Windows\{AB484B31-EC7E-4665-B198-B27A1BF5884E}.exe

Filesize
408KB

MD5
480c56dde86b877cc6e8550f35d0b238

SHA1
858e5c9a9f6f5f0a59e85bf5d61f5dad7a51a19a

SHA256
fbacdac5324b12127798f35089e2aed4b8423561baecf7134314e0e3d2a31a59

SHA512
8f7af61b7db595f20b28e8b33013ec3dc533d26da0d967b564c4cffac7fe52cf6b015bedc60fe8f18a7acc5e6420c5d362a44fd5dc9761b3b9a484649fc50fc0

Download Submit
C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe

Filesize
92KB

MD5
7f18535fdbe409bd4b6f19ac088025ab

SHA1
c8444c942ab2c6943d3fd29b787d288ddd517314

SHA256
6d67d3f46059022e920ebf6a645485f08b7da6a50fdab18aa5dd0ecce41d39d4

SHA512
d62c938fcfd024854ae6f00c4e1671320c7be8186e386dd8c9f6ee1fa972f436371da03648030a04b26a34ad8c34c41da17b3816f7c66d9a897e2c94c422251f

Download Submit
C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe

Filesize
75KB

MD5
6d37928d42df84a721552408c20c782d

SHA1
ecac86236807c3e8005093c09b808c116c2920a2

SHA256
e2b6327f47326727d1df534adee01ac3b5e6cf0e6795adadd5900eb2eeccd401

SHA512
2187801df71cd6f3c591d863ca974045ea06c552360f48f3db4492a248c5b72cc0733b3f7a46a2adf115ce6ed92631bb9ee9dc76de6ae1bef577e9eb645caafd

Download Submit
C:\Windows\{BD4AA77C-5F75-40d7-AABD-97E49237459B}.exe

Filesize
408KB

MD5
8e4d6828923dc9814d619ec88d88a218

SHA1
34f61e1d26ac904d19019cc63f88f9006de1bb06

SHA256
4372ecb4c40e1c756b2fc344ee937aad08ab9fb2b6b5a03d25e20b27ea37eee3

SHA512
454f7d94d4e561dc9c46eb2940406b11caa306c41ca4aabe47639b0c261e2977ea804640324fefd5debe7dff1659204ad50c5a4955c159eaad25904fada32146

Download Submit
C:\Windows\{D1DC989B-E0D5-4658-8FFE-39ED2D44620D}.exe

Filesize
408KB

MD5
7047590aeaaa9e5c28b93b56b776c999

SHA1
4d56c7c370e9c43af7ed7100c21cc176a4f57444

SHA256
30cd77cebf90bc18e2148ee7bb71cbad13b30643f0c559950faff5ddc448d5d5

SHA512
d9b64e065b6894880e52ed63459aabd2fed6cc34608667a5282caba3b12c5eaf7503fc9a68a82acf74a24c31a9ac8b8ba3e2708503a0d02e58a2d6aee1f05f18

Download Submit
C:\Windows\{E4B4C901-7F32-4ed5-9B33-470FD0B6FA4B}.exe

Filesize
408KB

MD5
80ac005ffa354c95ec04251e97945d9d

SHA1
7063bd588264497a7a315e0d9f77e32d16762e49

SHA256
723c0cb9bd961f91560cd6b532d2f2c8630a8982fe1a6c132ce20c7df408ff10

SHA512
2958c4e75790a0fd9b4b1ead0bf8f72921b7dfa8bc6706ce15f713492032875a1e34ace23d01f376e2146311219aec8f36c624a21518664e727ac7b169125203

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads