e59685ec4d071897532b431051e0e18189d231ddfc741e9f4ab1f79f36eb5dfd

Analysis

max time kernel
151s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 20:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
Size

192KB
MD5

2d15369c210273b502ba622410611ca0
SHA1

aefd8b0d2594dcd33b0cbcf8710ad89870722dd8
SHA256

e59685ec4d071897532b431051e0e18189d231ddfc741e9f4ab1f79f36eb5dfd
SHA512

91fca7c1447fed191fa3a83421943f752ae13a2d88aaea98677c06e5310410d08dc0147a618a9a7e4af8061cfaf448e2ab616ade95d1899e89799baab4e7bc02
SSDEEP

1536:1EGh0oBl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oBl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}	{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}\stubpath = "C:\\Windows\\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe"	{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}\stubpath = "C:\\Windows\\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe"	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}\stubpath = "C:\\Windows\\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe"	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}	{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79DB9580-026E-49bf-AFC4-CE8833A0119C}\stubpath = "C:\\Windows\\{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe"	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31570038-F204-435b-B28B-C346579FC6AC}	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31570038-F204-435b-B28B-C346579FC6AC}\stubpath = "C:\\Windows\\{31570038-F204-435b-B28B-C346579FC6AC}.exe"	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}	{31570038-F204-435b-B28B-C346579FC6AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{139F318C-917D-40fd-9225-17DB5F8B043B}\stubpath = "C:\\Windows\\{139F318C-917D-40fd-9225-17DB5F8B043B}.exe"	{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}\stubpath = "C:\\Windows\\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe"	{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}\stubpath = "C:\\Windows\\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe"	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}\stubpath = "C:\\Windows\\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe"	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}\stubpath = "C:\\Windows\\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe"	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C099457-CCDD-4f1b-A363-E46D9231298A}	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C099457-CCDD-4f1b-A363-E46D9231298A}\stubpath = "C:\\Windows\\{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe"	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79DB9580-026E-49bf-AFC4-CE8833A0119C}	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{139F318C-917D-40fd-9225-17DB5F8B043B}	{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}\stubpath = "C:\\Windows\\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe"	{31570038-F204-435b-B28B-C346579FC6AC}.exe

Deletes itself 1 IoCs

pid	Process
2568	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
1136	{31570038-F204-435b-B28B-C346579FC6AC}.exe
608	{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
2252	{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
2104	{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
2352	{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
File created	C:\Windows\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
File created	C:\Windows\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe	{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
File created	C:\Windows\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
File created	C:\Windows\{31570038-F204-435b-B28B-C346579FC6AC}.exe	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
File created	C:\Windows\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe	{31570038-F204-435b-B28B-C346579FC6AC}.exe
File created	C:\Windows\{139F318C-917D-40fd-9225-17DB5F8B043B}.exe	{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
File created	C:\Windows\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
File created	C:\Windows\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
File created	C:\Windows\{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
File created	C:\Windows\{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
File created	C:\Windows\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe	{139F318C-917D-40fd-9225-17DB5F8B043B}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
Token: SeIncBasePriorityPrivilege	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
Token: SeIncBasePriorityPrivilege	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
Token: SeIncBasePriorityPrivilege	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
Token: SeIncBasePriorityPrivilege	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
Token: SeIncBasePriorityPrivilege	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
Token: SeIncBasePriorityPrivilege	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
Token: SeIncBasePriorityPrivilege	1136	{31570038-F204-435b-B28B-C346579FC6AC}.exe
Token: SeIncBasePriorityPrivilege	608	{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
Token: SeIncBasePriorityPrivilege	2252	{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
Token: SeIncBasePriorityPrivilege	2104	{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2128	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	28
PID 2040 wrote to memory of 2128	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	28
PID 2040 wrote to memory of 2128	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	28
PID 2040 wrote to memory of 2128	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	28
PID 2040 wrote to memory of 2568	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	29
PID 2040 wrote to memory of 2568	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	29
PID 2040 wrote to memory of 2568	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	29
PID 2040 wrote to memory of 2568	2040	2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe	29
PID 2128 wrote to memory of 2952	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	30
PID 2128 wrote to memory of 2952	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	30
PID 2128 wrote to memory of 2952	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	30
PID 2128 wrote to memory of 2952	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	30
PID 2128 wrote to memory of 2620	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	31
PID 2128 wrote to memory of 2620	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	31
PID 2128 wrote to memory of 2620	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	31
PID 2128 wrote to memory of 2620	2128	{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe	31
PID 2952 wrote to memory of 2488	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	34
PID 2952 wrote to memory of 2488	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	34
PID 2952 wrote to memory of 2488	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	34
PID 2952 wrote to memory of 2488	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	34
PID 2952 wrote to memory of 2528	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	35
PID 2952 wrote to memory of 2528	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	35
PID 2952 wrote to memory of 2528	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	35
PID 2952 wrote to memory of 2528	2952	{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe	35
PID 2488 wrote to memory of 1504	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	36
PID 2488 wrote to memory of 1504	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	36
PID 2488 wrote to memory of 1504	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	36
PID 2488 wrote to memory of 1504	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	36
PID 2488 wrote to memory of 556	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	37
PID 2488 wrote to memory of 556	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	37
PID 2488 wrote to memory of 556	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	37
PID 2488 wrote to memory of 556	2488	{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe	37
PID 1504 wrote to memory of 1616	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	38
PID 1504 wrote to memory of 1616	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	38
PID 1504 wrote to memory of 1616	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	38
PID 1504 wrote to memory of 1616	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	38
PID 1504 wrote to memory of 1392	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	39
PID 1504 wrote to memory of 1392	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	39
PID 1504 wrote to memory of 1392	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	39
PID 1504 wrote to memory of 1392	1504	{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe	39
PID 1616 wrote to memory of 2888	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	40
PID 1616 wrote to memory of 2888	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	40
PID 1616 wrote to memory of 2888	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	40
PID 1616 wrote to memory of 2888	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	40
PID 1616 wrote to memory of 1528	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	41
PID 1616 wrote to memory of 1528	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	41
PID 1616 wrote to memory of 1528	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	41
PID 1616 wrote to memory of 1528	1616	{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe	41
PID 2888 wrote to memory of 740	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	42
PID 2888 wrote to memory of 740	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	42
PID 2888 wrote to memory of 740	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	42
PID 2888 wrote to memory of 740	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	42
PID 2888 wrote to memory of 2784	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	43
PID 2888 wrote to memory of 2784	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	43
PID 2888 wrote to memory of 2784	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	43
PID 2888 wrote to memory of 2784	2888	{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe	43
PID 740 wrote to memory of 1136	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	44
PID 740 wrote to memory of 1136	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	44
PID 740 wrote to memory of 1136	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	44
PID 740 wrote to memory of 1136	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	44
PID 740 wrote to memory of 2808	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	45
PID 740 wrote to memory of 2808	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	45
PID 740 wrote to memory of 2808	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	45
PID 740 wrote to memory of 2808	740	{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-03_2d15369c210273b502ba622410611ca0_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
  C:\Windows\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
    C:\Windows\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
      C:\Windows\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
        
        C:\Windows\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
        
        C:\Windows\{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
        
        C:\Windows\{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
        
        C:\Windows\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\{31570038-F204-435b-B28B-C346579FC6AC}.exe
        
        C:\Windows\{31570038-F204-435b-B28B-C346579FC6AC}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
        
        C:\Windows\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
        
        C:\Windows\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:608
        
        C:\Windows\{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
        
        C:\Windows\{139F318C-917D-40fd-9225-17DB5F8B043B}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Windows\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
        
        C:\Windows\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe
        
        C:\Windows\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe
        13⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AFE30~1.EXE > nul
        13⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{139F3~1.EXE > nul
        12⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B656F~1.EXE > nul
        11⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31570~1.EXE > nul
        10⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{353DB~1.EXE > nul
        9⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79DB9~1.EXE > nul
        8⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C099~1.EXE > nul
        7⤵
        
        PID:1528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A849~1.EXE > nul
        6⤵
        
        PID:1392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5423B~1.EXE > nul
        5⤵
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F049E~1.EXE > nul
      4⤵
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{01143~1.EXE > nul
    3⤵
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{01143F94-CBE8-49ac-9A8E-BA8217CFA87C}.exe

Filesize
192KB

MD5
2157a080393e3d61ea1f8b2ed066635c

SHA1
0c84d20c790c1cd1430f931c83b908d49eecda5a

SHA256
8618573c651c38e4fe7af75b06109a87e0a9d4671401681e29cf24d499d62bb9

SHA512
ccfb7e63bb8d55a8aa0a1e9eb97956e62d5b6b817f50f5c6fb766e546b15f071d08177fcdb31bdb43af8e25dadeb4f1572b4a7825c41190be466b4655a1004c9

Download Submit
C:\Windows\{139F318C-917D-40fd-9225-17DB5F8B043B}.exe

Filesize
192KB

MD5
785178eef000dcc23f38c46c9a1b7e0f

SHA1
b94ee6f4e6976c645958962e0afd08f9b5090c7b

SHA256
b5e71971fe2183ecaa19f92c77240f7f18e9a70df1cddf10f5573551b594b5a7

SHA512
33de5a401546834d5173512229e3689a79e81c642a729ce285ac85d8d72fe7bc837668a6ca9967dce9a73ddace8a184d8e8c7813196d4dd43fbbc6e6a518bfa4

Download Submit
C:\Windows\{21804158-85DF-45c2-AAE2-B75D9EE64CC6}.exe

Filesize
192KB

MD5
2fd0aa1a89bd585a4a59a5fcfd8e5fff

SHA1
0479ce33ef3a85db27e136b5fc99aef57086dd2c

SHA256
0654585dfb67e20e8a95d87bca63a24a90a689c18462f737a646fb2baf4ecf29

SHA512
ae4196c9968dfdefd45f6ef8fe00442574eeeb67245cae14d9c1117a35372451b354da9f68f5ce26183b0c614c20a5a5ad1725bb2337ee81178448b7decbbd1b

Download Submit
C:\Windows\{31570038-F204-435b-B28B-C346579FC6AC}.exe

Filesize
192KB

MD5
56c340f82f0926225bbd7061164f5c7b

SHA1
65c8f235e79ef20d0483d2432268efcf57e60677

SHA256
42008871359c08d6a5a351661b942feb64b1456d594b6c59dc2deb5e4481984a

SHA512
c6b3d2d1114591619ea0cc9f164efa46dac90a5a56772c01d01d182bf0df53be734b1df7f6c23a68b9bb3de842d9e37af285207b1abd24ebebbe9b28277769d5

Download Submit
C:\Windows\{353DB0A2-5EED-449e-BA0D-F1F2FDE0BABC}.exe

Filesize
192KB

MD5
c43e4738972056303f29b2d6c632f043

SHA1
84e7eae8b6af816342a3a47a106b22a06fdc5e37

SHA256
bd4f1680d141f1aada468d95ad204b2465225bb4154de4863905b9c730cb5d08

SHA512
6142428bc024fb7bee87d3ed62f55a562afb34a68b8085395b4c59f4f5097ea922d618207c7d8e04c62ed8bb1ff9031334ee557bf58c417656d9ecb8a9c348bb

Download Submit
C:\Windows\{3C099457-CCDD-4f1b-A363-E46D9231298A}.exe

Filesize
192KB

MD5
75d35318c20b343eebac6d93c9c0ccd3

SHA1
ebce4e8c5ae9bf351b5ae4bcd58db8bbc0998979

SHA256
29faaf131141ed225074d30f36e818d3ac2786e0adb8bfcfe5ab171dc5cea3cd

SHA512
06053d31a21ba0a8b8b2746e376d2d9848ef57fdd4831da808ec77fe810635ef32617082aab57936fe36020415a535c030884644175190d3fb399aea13dff3b1

Download Submit
C:\Windows\{5423B7E0-A28D-440b-A43F-B3A24A725CAB}.exe

Filesize
192KB

MD5
c2612648c77f5b96701f57edc59fd515

SHA1
d69064797004a94a7ef8cab02459d50933e1b03e

SHA256
77ec4e2bc49a0180b45e700654188d6923e024ab197a7f5849f67c95f4e8d84d

SHA512
fe9413221b1e0aa9de26f6ddb12f888148655fac014f3905a2f7c2d250758a95afd0f93413c282afc40562fa35a30cdc3a4b3b326c5918ca3133c181e99c66db

Download Submit
C:\Windows\{79DB9580-026E-49bf-AFC4-CE8833A0119C}.exe

Filesize
192KB

MD5
84ed2f7692c2eba99b81842dc3a0c74b

SHA1
459e0260cde71199625f8a027af04ba3f058871a

SHA256
c840767404a3c9b49b93305c11097f7bdda75c25ff46088c11f758bafe348dbe

SHA512
58b42a7348bc6cf77a4a8f70cc9d5a970530a9b21d2ba972c2394cfc39addc616621d57a8b1df40950023cb93f1b8ef55425ec158fbf8024d6d08df9debbdb34

Download Submit
C:\Windows\{8A849B32-C80C-4cb1-A64F-816ECB0730FC}.exe

Filesize
192KB

MD5
1463584bcea0ed3f8e38427236295e02

SHA1
45c01a2e685b0a5e7aef5ae68261ad3bd17cba1c

SHA256
d70d18989056e712694487c76658eaae70a422b21b5d597a65bb6be3c359ff36

SHA512
372866d50fc0c915ff5162e0f31c745f267d5e8aba0ff119b9fbdab893e9aa7a08ab813a738ef64473234b09e8725f39cd153e4de21160b203886bf425d18dd7

Download Submit
C:\Windows\{AFE30E1A-0CA8-4ed8-AF93-2CD4C2970445}.exe

Filesize
192KB

MD5
90fc620d432e1dffcefb64588fc5be0d

SHA1
24806fd841d8a290a74794f6c62c2165a02e3129

SHA256
2bf942bd9176276727f18c62da3072da4fb20d271f6b3980b21eefd9a69da0f4

SHA512
85eaa8dfc83ac5c0ad4d7dde6c4eaaa7b4ef6f2c32105bbbe8b8d0f4219ef78608375efa2508f1f61088ea64a833089d3d256e6ece1fcd6df6ba5f8b2a2878cf

Download Submit
C:\Windows\{B656F093-B9C8-4ab7-BE9A-902680B4B8D7}.exe

Filesize
192KB

MD5
c96f772959d8ed98c49fc6bceb4930bc

SHA1
2473b6917d05319076dec804dc941b1a33d3097b

SHA256
518ec9d15d8d61f16d7af177dd65eaf28ff131c1c04f2910ee0817873a71dd41

SHA512
66355fd491580c0a1c450b9dce4fd6d42915265cffa0ac6e83762eee7e0b50bcce9890400119755698ba488b07ab9a6452cc9c251a4ff424665a72d087c81d07

Download Submit
C:\Windows\{F049E95C-EAC8-41d3-B361-D27CE3C2B156}.exe

Filesize
192KB

MD5
4b4480bb7784ad6b26dc2d44cf4984e4

SHA1
12220bbf90962a011e6c8dde1bc614793986f254

SHA256
b1ef2ecb684318f3acc09e08453481fa144c7805465870c703ffd1c8a96c2be4

SHA512
529a7709e3604fd4e706366991b2b08dd84ce56dfb955307e2ebb131bbc71e1ac8f5374bb8796eace9fb1da05820ed757d58358516a2dd09573699ca298f2621

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads