22018eda162b32d9e94864666abdc83260dca552c7aee29c1a45301228527cc0

Analysis

max time kernel
149s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
Size

216KB
MD5

f95ddd59a0b0fe59620cb8e78ee19334
SHA1

a13db8b2d3805e305d4220016cad66b02d0e8dfc
SHA256

22018eda162b32d9e94864666abdc83260dca552c7aee29c1a45301228527cc0
SHA512

64b818b93bcdc7e020bd069f7e56a230e6e10c267e4d1ccb9b1dc9347f204fb820b561206b09737d12adc7271aecbdf3785357d9dc6cf082a96650688fba4109
SSDEEP

3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGLlEeKcAEcGy

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{802B8939-3391-404c-A9A4-D4899A149B96}	{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}\stubpath = "C:\\Windows\\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe"	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}\stubpath = "C:\\Windows\\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe"	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}\stubpath = "C:\\Windows\\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe"	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}\stubpath = "C:\\Windows\\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe"	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF016959-D04B-4e24-8E20-013F309D58F3}	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAE367CC-C3EA-43c8-BB52-6EC954490715}	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{223F0ED6-11F7-4a35-96F3-A897498D3532}	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}\stubpath = "C:\\Windows\\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe"	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}\stubpath = "C:\\Windows\\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe"	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}\stubpath = "C:\\Windows\\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe"	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{223F0ED6-11F7-4a35-96F3-A897498D3532}\stubpath = "C:\\Windows\\{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe"	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF016959-D04B-4e24-8E20-013F309D58F3}\stubpath = "C:\\Windows\\{FF016959-D04B-4e24-8E20-013F309D58F3}.exe"	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C079203D-9D6C-4acb-B194-B893E2E93022}	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C079203D-9D6C-4acb-B194-B893E2E93022}\stubpath = "C:\\Windows\\{C079203D-9D6C-4acb-B194-B893E2E93022}.exe"	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAE367CC-C3EA-43c8-BB52-6EC954490715}\stubpath = "C:\\Windows\\{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe"	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{802B8939-3391-404c-A9A4-D4899A149B96}\stubpath = "C:\\Windows\\{802B8939-3391-404c-A9A4-D4899A149B96}.exe"	{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe

Executes dropped EXE 12 IoCs

pid	Process
5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
2392	{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe
4436	{802B8939-3391-404c-A9A4-D4899A149B96}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
File created	C:\Windows\{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
File created	C:\Windows\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
File created	C:\Windows\{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
File created	C:\Windows\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
File created	C:\Windows\{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
File created	C:\Windows\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
File created	C:\Windows\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
File created	C:\Windows\{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
File created	C:\Windows\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
File created	C:\Windows\{802B8939-3391-404c-A9A4-D4899A149B96}.exe	{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe
File created	C:\Windows\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
Token: SeIncBasePriorityPrivilege	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
Token: SeIncBasePriorityPrivilege	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
Token: SeIncBasePriorityPrivilege	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
Token: SeIncBasePriorityPrivilege	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
Token: SeIncBasePriorityPrivilege	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
Token: SeIncBasePriorityPrivilege	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
Token: SeIncBasePriorityPrivilege	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
Token: SeIncBasePriorityPrivilege	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
Token: SeIncBasePriorityPrivilege	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
Token: SeIncBasePriorityPrivilege	4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
Token: SeIncBasePriorityPrivilege	2392	{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5096	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	86
PID 4148 wrote to memory of 5096	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	86
PID 4148 wrote to memory of 5096	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	86
PID 4148 wrote to memory of 412	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	87
PID 4148 wrote to memory of 412	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	87
PID 4148 wrote to memory of 412	4148	2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe	87
PID 5096 wrote to memory of 1800	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	90
PID 5096 wrote to memory of 1800	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	90
PID 5096 wrote to memory of 1800	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	90
PID 5096 wrote to memory of 4988	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	91
PID 5096 wrote to memory of 4988	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	91
PID 5096 wrote to memory of 4988	5096	{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe	91
PID 1800 wrote to memory of 2724	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	94
PID 1800 wrote to memory of 2724	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	94
PID 1800 wrote to memory of 2724	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	94
PID 1800 wrote to memory of 3684	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	95
PID 1800 wrote to memory of 3684	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	95
PID 1800 wrote to memory of 3684	1800	{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe	95
PID 2724 wrote to memory of 3420	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	96
PID 2724 wrote to memory of 3420	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	96
PID 2724 wrote to memory of 3420	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	96
PID 2724 wrote to memory of 1032	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	97
PID 2724 wrote to memory of 1032	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	97
PID 2724 wrote to memory of 1032	2724	{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe	97
PID 3420 wrote to memory of 1792	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	98
PID 3420 wrote to memory of 1792	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	98
PID 3420 wrote to memory of 1792	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	98
PID 3420 wrote to memory of 1640	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	99
PID 3420 wrote to memory of 1640	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	99
PID 3420 wrote to memory of 1640	3420	{FF016959-D04B-4e24-8E20-013F309D58F3}.exe	99
PID 1792 wrote to memory of 1680	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	100
PID 1792 wrote to memory of 1680	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	100
PID 1792 wrote to memory of 1680	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	100
PID 1792 wrote to memory of 1636	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	101
PID 1792 wrote to memory of 1636	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	101
PID 1792 wrote to memory of 1636	1792	{C079203D-9D6C-4acb-B194-B893E2E93022}.exe	101
PID 1680 wrote to memory of 4028	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	102
PID 1680 wrote to memory of 4028	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	102
PID 1680 wrote to memory of 4028	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	102
PID 1680 wrote to memory of 3304	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	103
PID 1680 wrote to memory of 3304	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	103
PID 1680 wrote to memory of 3304	1680	{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe	103
PID 4028 wrote to memory of 2004	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	104
PID 4028 wrote to memory of 2004	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	104
PID 4028 wrote to memory of 2004	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	104
PID 4028 wrote to memory of 3116	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	105
PID 4028 wrote to memory of 3116	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	105
PID 4028 wrote to memory of 3116	4028	{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe	105
PID 2004 wrote to memory of 3168	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	106
PID 2004 wrote to memory of 3168	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	106
PID 2004 wrote to memory of 3168	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	106
PID 2004 wrote to memory of 1564	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	107
PID 2004 wrote to memory of 1564	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	107
PID 2004 wrote to memory of 1564	2004	{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe	107
PID 3168 wrote to memory of 4748	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	108
PID 3168 wrote to memory of 4748	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	108
PID 3168 wrote to memory of 4748	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	108
PID 3168 wrote to memory of 1192	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	109
PID 3168 wrote to memory of 1192	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	109
PID 3168 wrote to memory of 1192	3168	{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe	109
PID 4748 wrote to memory of 2392	4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe	110
PID 4748 wrote to memory of 2392	4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe	110
PID 4748 wrote to memory of 2392	4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe	110
PID 4748 wrote to memory of 872	4748	{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe	111

C:\Users\Admin\AppData\Local\Temp\2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-03_f95ddd59a0b0fe59620cb8e78ee19334_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
  C:\Windows\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
    C:\Windows\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
      C:\Windows\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
        
        C:\Windows\{FF016959-D04B-4e24-8E20-013F309D58F3}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
        
        C:\Windows\{C079203D-9D6C-4acb-B194-B893E2E93022}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
        
        C:\Windows\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
        
        C:\Windows\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
        
        C:\Windows\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
        
        C:\Windows\{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
        
        C:\Windows\{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe
        
        C:\Windows\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\{802B8939-3391-404c-A9A4-D4899A149B96}.exe
        
        C:\Windows\{802B8939-3391-404c-A9A4-D4899A149B96}.exe
        13⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C34AD~1.EXE > nul
        13⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{223F0~1.EXE > nul
        12⤵
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EAE36~1.EXE > nul
        11⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C6EB~1.EXE > nul
        10⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CCA86~1.EXE > nul
        9⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FCAE~1.EXE > nul
        8⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C0792~1.EXE > nul
        7⤵
        
        PID:1636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF016~1.EXE > nul
        6⤵
        
        PID:1640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF907~1.EXE > nul
        5⤵
        
        PID:1032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{0051B~1.EXE > nul
      4⤵
      PID:3684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2CFF5~1.EXE > nul
    3⤵
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0051BB36-0B20-42f7-B1B1-9B913AE22D09}.exe

Filesize
216KB

MD5
3982579f2d6266cabb8f7b0f8f85f660

SHA1
6744572932d99ebbdb50382e2c714cfc3c114238

SHA256
4321f66458349065dbe395e7e08bdbd0fbaf158b4b8e127602e28fbfa76b668a

SHA512
2a906897e37973167da2c8ea5e8584fca2c86395a4d6b4241289daf1f294fae999dfbc3733609bd4b337569f2a87ac000531370a23c541cfdf2f9927895510d9

Download Submit
C:\Windows\{223F0ED6-11F7-4a35-96F3-A897498D3532}.exe

Filesize
216KB

MD5
71af35c669b336caaee8cd9739def290

SHA1
6e341f21bcb2439c3fd0f3026289b13e55f88f75

SHA256
8560724c1458211efd299bdad5433a186f9b940eb490e5f8a41be14fd595466b

SHA512
03b933ea33ae4b066999e28fdbcc9891e3ee772145c616708ea4bd8e246c96b5c69c97e3a84b6e113954a6d4fc28da069bc9387182bae2b6e4121b62bb427240

Download Submit
C:\Windows\{2CFF5BEA-3D0D-4788-A50F-6E398B853955}.exe

Filesize
216KB

MD5
55069c1bf7f6b45d126e67d10218c74b

SHA1
1e8eb73e0705a98e29e4280c6c36e65b3f726e81

SHA256
27091d8e6d3a359fe625c24e9c31d7bb5370260621efffb737d8b8367693c9c9

SHA512
be9ec64a9f00517b9b1d5e31c565300e93bdee56c58818b9a6dd3595c45606da9ca11d9fadfb2cbdc4d4d1167de1859195234440214d553514b2d2d63316e8c3

Download Submit
C:\Windows\{7C6EBB7C-3A62-4942-8A3F-243463A6B111}.exe

Filesize
216KB

MD5
75e3cc43df047ffc203339a93c241c98

SHA1
1ab1f1f2ef536890bbc9dd691a8a2b8813617bf7

SHA256
0a33fb48069d0732b25a4d63cb4ef6c8c21a67ae039d3572f48fd1f7d6cf8dc8

SHA512
d609ca0d8279fa686d14abacccee8fc1843d03c467ce635dfc0d0e2be18b7a10f53661df7b69ad24d3a0c8f16b3a216698eec9b70535cc83a464873d8f527146

Download Submit
C:\Windows\{802B8939-3391-404c-A9A4-D4899A149B96}.exe

Filesize
216KB

MD5
74eebaea4386404cc6091ff136ec061d

SHA1
940dcf479c84dbaf19278b693aa4c37f1e220e48

SHA256
7a34d79defcea980bc587be20296e990998f8de693f22877ca498046e1ea5e96

SHA512
a93478947e1179724706074b308e76dd6c5e6ead0e58c3052766d7d56ad50ce7e6ac7e5fb779b865d9bc67fcb2dc2ac76c52abb7f54909a34d3d15ff24a48da0

Download Submit
C:\Windows\{9FCAE7A5-2D8C-4ac7-BEAD-1DA677A2B985}.exe

Filesize
216KB

MD5
b95b9347c56ae9f5b6bbe01f453a0c47

SHA1
b7b098785be4c86ee4cdc4b4934500ce3cd97c91

SHA256
1875cf46d2d49edc064cb82ed0d31a771b80242be94aa38d8dddb233781c6164

SHA512
bda610e070c1290ec42c6c34e16317ce2790206f0f47f6f52d2109ba9b8626acf074130c405584b677359b577102368ef46f5309e4200fc76be87b4bfb72ea4e

Download Submit
C:\Windows\{AF90747C-CA27-4ec8-8D58-FD441E937BB1}.exe

Filesize
216KB

MD5
e6009651a2c723f6872f207a98cb959c

SHA1
9020b504c1adedc06720c70d84b274c89fb59272

SHA256
122b563e74dd13971580b5537f59bd2a5cb7203fb2145684d501d22c6b5761de

SHA512
8a76aab098d8250ac91f0d0823e86e3d8cc5bb07dc3c381cc67703d9733699edd945ad40f4d55634f8dadc3a0e485d1bc16b45d0e14a889973c1c3472caaf86e

Download Submit
C:\Windows\{C079203D-9D6C-4acb-B194-B893E2E93022}.exe

Filesize
216KB

MD5
d8c3c0cb9904000f6cd15ca30fa6ebe8

SHA1
5686000f7529bf3d41b8cbcd41c3273f48dcebbb

SHA256
2c9a18084a20871e6d0280e856e8f39753560785f715bce677184cfaa9166c9c

SHA512
9086adec11afce35f00942f41a9ca1af12048e968229a161c7b093b19faeed9cf33e23613552813a4d9e92e11a576b7a25b81756d8a2b324401d6b981a8710c3

Download Submit
C:\Windows\{C34ADAC8-DEEA-47bf-B2DB-DD2377EB8BB9}.exe

Filesize
216KB

MD5
ba1e3809368905755f1a9d045c6fb6b3

SHA1
ec976a8da9cdb3afe1e8200fa20dc6248e2399f6

SHA256
8693f1c4d4d943539277dee8de1a8b3bfd15b617ce1dc058554441169a38e83b

SHA512
b62c73f9633ca7468c91afe9807b36189467fdfbdd6b370bdfe2a55f33f3005e491068b476d7677635c4ad0329d82e358bb7c95ea0f8547496f4ed13ad9a9f1e

Download Submit
C:\Windows\{CCA86EA4-1B64-4948-81B7-176E5F6C922E}.exe

Filesize
216KB

MD5
d96a2825eff82bd4b41b694cd57f0700

SHA1
410930d30316244e06f8b00b81764b5173075a8f

SHA256
9ca9bdf75afa8ed84eef729972fd5dbe3230087e82513c5c5d469b3621de3e16

SHA512
124f4ffb5c6289808e1b0517ceec3b112baa5b0a6afd306a00201d95a568512d91b80deb63b16addce4ce095c8727592e8810fe86afaf86af880437e3de72f36

Download Submit
C:\Windows\{EAE367CC-C3EA-43c8-BB52-6EC954490715}.exe

Filesize
216KB

MD5
56b118b6300b2807b08ff62623f3a233

SHA1
275ecdacb037c8ab77d80550ce7a25c954ecb528

SHA256
9cb1f253551aa8a3d944968bf4bf30d92d93be7fe58b6001232ce3c58bbdf88b

SHA512
385b0559561c7a4c925b01e3885ee3bfc6d9c55f0be6f304a17735517fdd18d75885062b0ffa20f21238861a217c6ff2e2bb58adfea64bbf716a66506624b5be

Download Submit
C:\Windows\{FF016959-D04B-4e24-8E20-013F309D58F3}.exe

Filesize
216KB

MD5
f9ec2073fab879f2d5fceb58190c45a7

SHA1
ac3c70f3350816890e93c70d7b122678b93d4150

SHA256
1ab0ba65984363d3b9e6762d7289498df460e0d0316588ddf08658c43d6e96fa

SHA512
ee417b172f274efb2e4be27fb38005448dd1b83786a43ba663a37d481567068a761275d866fdb597c700915c4e74e554ddd5812921311858168e9238b72a832b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads