76a836c7692328c1a5346cc053cc771e441a781f30b2ff1532afee6a139144ed

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
Size

197KB
MD5

ec84a992592d437b486e4256a900df0f
SHA1

81b116b3f10585b221f8be8e821f59c197c0f4d7
SHA256

76a836c7692328c1a5346cc053cc771e441a781f30b2ff1532afee6a139144ed
SHA512

fe3e34fda3bb2b247c09f5e589f17cafee3340cc4afa51696f995ae82b18394f1bcad2eccedf9a53c5a00d2c1b96814d82839e1d67f1b4bcb7edc03ee3f63d06
SSDEEP

3072:jEGh0ozl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG9lEeKcAEca

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}\stubpath = "C:\\Windows\\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe"	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}\stubpath = "C:\\Windows\\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe"	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}\stubpath = "C:\\Windows\\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe"	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}\stubpath = "C:\\Windows\\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe"	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F6073E9-FF4C-4930-9461-5257AC6318D0}	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}\stubpath = "C:\\Windows\\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe"	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}\stubpath = "C:\\Windows\\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe"	{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}\stubpath = "C:\\Windows\\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe"	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}	{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAC52617-FE1F-4942-A61B-D81692F16016}	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}\stubpath = "C:\\Windows\\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe"	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}\stubpath = "C:\\Windows\\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe"	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F6073E9-FF4C-4930-9461-5257AC6318D0}\stubpath = "C:\\Windows\\{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe"	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}\stubpath = "C:\\Windows\\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe"	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAC52617-FE1F-4942-A61B-D81692F16016}\stubpath = "C:\\Windows\\{CAC52617-FE1F-4942-A61B-D81692F16016}.exe"	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe

Executes dropped EXE 12 IoCs

pid	Process
1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
5004	{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
3000	{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
File created	C:\Windows\{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
File created	C:\Windows\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
File created	C:\Windows\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
File created	C:\Windows\{CAC52617-FE1F-4942-A61B-D81692F16016}.exe	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
File created	C:\Windows\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe	{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
File created	C:\Windows\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
File created	C:\Windows\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
File created	C:\Windows\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
File created	C:\Windows\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
File created	C:\Windows\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
File created	C:\Windows\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
Token: SeIncBasePriorityPrivilege	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
Token: SeIncBasePriorityPrivilege	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
Token: SeIncBasePriorityPrivilege	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
Token: SeIncBasePriorityPrivilege	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
Token: SeIncBasePriorityPrivilege	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
Token: SeIncBasePriorityPrivilege	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
Token: SeIncBasePriorityPrivilege	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
Token: SeIncBasePriorityPrivilege	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
Token: SeIncBasePriorityPrivilege	1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
Token: SeIncBasePriorityPrivilege	5004	{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1120	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	85
PID 4476 wrote to memory of 1120	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	85
PID 4476 wrote to memory of 1120	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	85
PID 4476 wrote to memory of 1604	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	86
PID 4476 wrote to memory of 1604	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	86
PID 4476 wrote to memory of 1604	4476	2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe	86
PID 1120 wrote to memory of 5048	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	87
PID 1120 wrote to memory of 5048	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	87
PID 1120 wrote to memory of 5048	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	87
PID 1120 wrote to memory of 5064	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	88
PID 1120 wrote to memory of 5064	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	88
PID 1120 wrote to memory of 5064	1120	{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe	88
PID 5048 wrote to memory of 4896	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	92
PID 5048 wrote to memory of 4896	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	92
PID 5048 wrote to memory of 4896	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	92
PID 5048 wrote to memory of 1928	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	93
PID 5048 wrote to memory of 1928	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	93
PID 5048 wrote to memory of 1928	5048	{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe	93
PID 4896 wrote to memory of 3392	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	94
PID 4896 wrote to memory of 3392	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	94
PID 4896 wrote to memory of 3392	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	94
PID 4896 wrote to memory of 2300	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	95
PID 4896 wrote to memory of 2300	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	95
PID 4896 wrote to memory of 2300	4896	{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe	95
PID 3392 wrote to memory of 2016	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	96
PID 3392 wrote to memory of 2016	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	96
PID 3392 wrote to memory of 2016	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	96
PID 3392 wrote to memory of 4500	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	97
PID 3392 wrote to memory of 4500	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	97
PID 3392 wrote to memory of 4500	3392	{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe	97
PID 2016 wrote to memory of 5068	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	98
PID 2016 wrote to memory of 5068	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	98
PID 2016 wrote to memory of 5068	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	98
PID 2016 wrote to memory of 3424	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	99
PID 2016 wrote to memory of 3424	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	99
PID 2016 wrote to memory of 3424	2016	{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe	99
PID 5068 wrote to memory of 2476	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	100
PID 5068 wrote to memory of 2476	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	100
PID 5068 wrote to memory of 2476	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	100
PID 5068 wrote to memory of 3712	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	101
PID 5068 wrote to memory of 3712	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	101
PID 5068 wrote to memory of 3712	5068	{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe	101
PID 2476 wrote to memory of 632	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	102
PID 2476 wrote to memory of 632	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	102
PID 2476 wrote to memory of 632	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	102
PID 2476 wrote to memory of 2380	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	103
PID 2476 wrote to memory of 2380	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	103
PID 2476 wrote to memory of 2380	2476	{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe	103
PID 632 wrote to memory of 2684	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	104
PID 632 wrote to memory of 2684	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	104
PID 632 wrote to memory of 2684	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	104
PID 632 wrote to memory of 1456	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	105
PID 632 wrote to memory of 1456	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	105
PID 632 wrote to memory of 1456	632	{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe	105
PID 2684 wrote to memory of 1036	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	106
PID 2684 wrote to memory of 1036	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	106
PID 2684 wrote to memory of 1036	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	106
PID 2684 wrote to memory of 372	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	107
PID 2684 wrote to memory of 372	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	107
PID 2684 wrote to memory of 372	2684	{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe	107
PID 1036 wrote to memory of 5004	1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe	108
PID 1036 wrote to memory of 5004	1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe	108
PID 1036 wrote to memory of 5004	1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe	108
PID 1036 wrote to memory of 648	1036	{CAC52617-FE1F-4942-A61B-D81692F16016}.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_ec84a992592d437b486e4256a900df0f_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
  C:\Windows\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
    C:\Windows\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
      C:\Windows\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
        
        C:\Windows\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3392
      - C:\Windows\{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
        
        C:\Windows\{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
        
        C:\Windows\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
        
        C:\Windows\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
        
        C:\Windows\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
        
        C:\Windows\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
        
        C:\Windows\{CAC52617-FE1F-4942-A61B-D81692F16016}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
        
        C:\Windows\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Windows\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe
        
        C:\Windows\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe
        13⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{707C4~1.EXE > nul
        13⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CAC52~1.EXE > nul
        12⤵
        
        PID:648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{018DD~1.EXE > nul
        11⤵
        
        PID:372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C789E~1.EXE > nul
        10⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A15A4~1.EXE > nul
        9⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4343A~1.EXE > nul
        8⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7F607~1.EXE > nul
        7⤵
        
        PID:3424
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B96D~1.EXE > nul
        6⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FA9F~1.EXE > nul
        5⤵
        
        PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{52EDA~1.EXE > nul
      4⤵
      PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FFE93~1.EXE > nul
    3⤵
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{018DD62A-50F4-4a2a-98F0-C39F08F62B99}.exe

Filesize
197KB

MD5
1aa2a75fc5e6f2244c588369e501d170

SHA1
3ef33a389ceae1c74c231eb1a88b4c008f258516

SHA256
d8b2e5ecd830cb66e2092352e8721582cf201b675663b91b5980602fbea74e54

SHA512
bfc27db3085f0ab4c763e87c6aa64b3c99645f88e55aacffebff071e80c2db1457d717a7f12bf0409d8f40ff76f0760ba061903839e3f0981222888922b281db

Download Submit
C:\Windows\{1FA9F0EB-F18C-4313-AAFE-6D063C8BB200}.exe

Filesize
197KB

MD5
09c4057693cbfef6c27a1c1fc1940d77

SHA1
3ecd5268090d9e63aa7b0e43ace9bd18422fa435

SHA256
371ec7ba890720e8f8ad3385ab582df97835e173b1f42d899f949a3a1253312c

SHA512
1f3b81a045ca4076b8ed6cba64dfb8b08c235ec60bcad291efb5ee1eb141141a09e1158aac26e2eecc9b55337fb2e01f0b3b0fead1ad0f85489b268a4afc4beb

Download Submit
C:\Windows\{4343A9B9-88CA-4327-9E49-F82CE0D04FE5}.exe

Filesize
197KB

MD5
c7fcce50cafea9689ee385893669089c

SHA1
9a6037e16e9e73e576da2df61548ab05d4a8daf9

SHA256
bf273c56033cdfe5f5035b69f230a4cbe6b1df60bdb108fe5b22b18202640002

SHA512
68c89090c6f076bcea92c843b7a4a8ebc898a26d334190b67e4013f73460a3e704a0a53cdff8a76912c66b94830adbffce8903895ce97887470ab0600d5f79c1

Download Submit
C:\Windows\{52EDAE6A-1428-43eb-BA5D-F7994D74E11E}.exe

Filesize
197KB

MD5
43979926e532a60798cf505ebdcbcfd9

SHA1
1ece724a4d038cbbf73a843a42b26aa362032549

SHA256
256e45420b3c344ac3b68e848e0f10e3e06b9701e633be8145cbe8c90e31cc90

SHA512
5c63fab6339c1aa3b06f48ab2275559c7d8362f0c6c7f99fabcf2101479a1d91f51e42ff58d778eb5be38d2d162deeb3c2369218319c15c920910d4f922c679b

Download Submit
C:\Windows\{707C4E81-F9BF-4a66-BFD8-F22E8DE8D1EC}.exe

Filesize
197KB

MD5
dce69274869cb24ab1cd93c3cff2474d

SHA1
129f3bec849c909d8c6bf70f128f0c2eaf677530

SHA256
e868b92df08181be3a5b06e05683f5210292f48b4e2207db103fca88b38f39b7

SHA512
aacf603d137b34730c565ef4ab9e1529c19f9d6bf417866b8dfb1ec82ff21b3743fefcf7e6ca449776345652126250a6eea7531dc80bf2f71a5cf0a0c011b505

Download Submit
C:\Windows\{73FC8F68-885C-409a-B33D-1D2C71F4FA22}.exe

Filesize
197KB

MD5
40c6f949f65c52a062756e231c3cf993

SHA1
b6e6d46b3141fd13c58c80180eb8a04b8987ddd9

SHA256
2737dce406c9f20f88f4e4c3e2c43d7c69e357a3ad99a2e37a6fe609da3e6d48

SHA512
cf2be586594094892cdf328b1b657edcfa715326047c0f4a5619e7c53f39586803357fb9b3d57b5fb94bb5768ef8364199d4fb750b6eba39d89d2edc4e609877

Download Submit
C:\Windows\{7F6073E9-FF4C-4930-9461-5257AC6318D0}.exe

Filesize
197KB

MD5
b4d7c4d9754f58ee2a27e52098dac11b

SHA1
5323f59292bf0902e053dbae91d01706abe4921b

SHA256
f9460b233656dc88029ff5323ae83df70a4264482166cf32ae326049806745e1

SHA512
d11ce14b6e0aadbf856e21d74ccbe0ee1e15b0e3f60efb4b56e2d73a7f30e869f24ab108e332343c94f44921e7a8292ffc66555b79dd0cb0fbb73d853d7d0b67

Download Submit
C:\Windows\{9B96DBCF-508F-4494-A3BC-ADC765A8350F}.exe

Filesize
197KB

MD5
28f936723075eb39158d3b9ac51ca525

SHA1
8dffd461c130ab11818583448207d5d6b937df64

SHA256
71603db624d0977b2d41beea3d29f82d3cf62a21d9f770c78e78c00e90fb1f19

SHA512
1182a37952d1bf9c4281a65eded36ccc6f7268f03925377ee214d069893834ec59cbf232a4e698e3f465fb5bca272b53ebacc3fb167b2b88a3e128796fa5530e

Download Submit
C:\Windows\{A15A4D0D-CE0A-49d2-9940-97E23DF218E7}.exe

Filesize
197KB

MD5
09b04611a168211e2c0242f76d934666

SHA1
3f970b38c47e2afe8fc286ee3d68eddabe452bb0

SHA256
551829277c290705e1d433c54233122fe96899c38cdfe543628c57702378f6d8

SHA512
a8566e2f4e4ffb381bca7f1a541126abaf70bfcc262fa91568e2cabcd8e81d26de58220cd02028ff8a9b3748b634b72096abbea452403871a758b2b7cd563414

Download Submit
C:\Windows\{C789EB53-7A2B-410c-A0E3-35FD3F25263D}.exe

Filesize
197KB

MD5
95a5a082155bfd62997d6d1909f728cd

SHA1
60299c56983c77ecce7e694de8ccfa4d28971a53

SHA256
fd898af0055d0922a3ac2e0510894d9762791c1b626544c19eb6418f6b7af61d

SHA512
ff1f6332cdd38368d8b1812c4d630e505ab5a316b9dd3dbf33e42f3020614ec2bfd7d05dd6d982b27e5afce8e740fc27d8623b53e0e447ce99d6b0e302b28657

Download Submit
C:\Windows\{CAC52617-FE1F-4942-A61B-D81692F16016}.exe

Filesize
197KB

MD5
3271432613cbd5ea7914afababc62c7e

SHA1
a6fb27351759a2fda0e00543360286c3a63ce62f

SHA256
630113deb097f80ed5980261a89898421376913483c6d89b0749fb60ad6475b0

SHA512
48816cf73261d7bcb8c90370efba9aa3b54b0fadd5583be4822089757145583fa92915370b923880c0644293c3831dcfc25d48efa02d9ff7c62470a4cf52f970

Download Submit
C:\Windows\{FFE93460-0ADA-4ef9-B1A7-AB400EE9B333}.exe

Filesize
197KB

MD5
ad6c46899a278e5ff970bbd072898c82

SHA1
5473bf8b501e0fc7b6356cfcb78d34d9216ff52f

SHA256
54da49def62f968897633c8975017c1962d542e8519a27d8e7a9f25895af3a35

SHA512
2e607dc9317fcca13e840d6222169d5b6983c8909eb9cce034527a5f941e2bb3e2ee42f57fccb2908ceb155bf34b4241bd4c9df170b2bd0e1c3760c975334e53

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads