650268c7d42e99e21ae54263808e6e24ee776a6a1b1ce3a3e01b0dcc202e391d

Analysis

max time kernel
149s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
Size

192KB
MD5

566b881c0b5202056eea3b88fbb6c50a
SHA1

cb3d131f1a314307f3b2491f22d6220408358788
SHA256

650268c7d42e99e21ae54263808e6e24ee776a6a1b1ce3a3e01b0dcc202e391d
SHA512

46b12735fee5b75e748fdb1dbb57a610c36a8eb25e670090864a102a5d87c6d8d3d880c94c9783b2a9159ee517f20f863b18d1e9f54e8b903fb7da2b30464a36
SSDEEP

1536:1EGh0otl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0otl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}\stubpath = "C:\\Windows\\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe"	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1AD9D3C-7270-413f-8DDB-5327C5017703}	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B75BB127-82C9-495b-B576-FF350504C85C}	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B75BB127-82C9-495b-B576-FF350504C85C}\stubpath = "C:\\Windows\\{B75BB127-82C9-495b-B576-FF350504C85C}.exe"	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}	{B75BB127-82C9-495b-B576-FF350504C85C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}\stubpath = "C:\\Windows\\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe"	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}\stubpath = "C:\\Windows\\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe"	{9186A73A-F982-49d2-91F7-53871B58C678}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}	{9186A73A-F982-49d2-91F7-53871B58C678}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A68F93B3-E930-41c9-9471-93E18A06B72E}	{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1AD9D3C-7270-413f-8DDB-5327C5017703}\stubpath = "C:\\Windows\\{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe"	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9186A73A-F982-49d2-91F7-53871B58C678}	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9186A73A-F982-49d2-91F7-53871B58C678}\stubpath = "C:\\Windows\\{9186A73A-F982-49d2-91F7-53871B58C678}.exe"	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A68F93B3-E930-41c9-9471-93E18A06B72E}\stubpath = "C:\\Windows\\{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe"	{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}\stubpath = "C:\\Windows\\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe"	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}\stubpath = "C:\\Windows\\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe"	{B75BB127-82C9-495b-B576-FF350504C85C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68624463-E74E-4543-A3AD-0D2BB61C504E}	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68624463-E74E-4543-A3AD-0D2BB61C504E}\stubpath = "C:\\Windows\\{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe"	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}\stubpath = "C:\\Windows\\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe"	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}\stubpath = "C:\\Windows\\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe"	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe

Executes dropped EXE 12 IoCs

pid	Process
3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe
4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe
3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
1964	{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
388	{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
File created	C:\Windows\{9186A73A-F982-49d2-91F7-53871B58C678}.exe	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
File created	C:\Windows\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
File created	C:\Windows\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	{B75BB127-82C9-495b-B576-FF350504C85C}.exe
File created	C:\Windows\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
File created	C:\Windows\{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
File created	C:\Windows\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
File created	C:\Windows\{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
File created	C:\Windows\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe	{9186A73A-F982-49d2-91F7-53871B58C678}.exe
File created	C:\Windows\{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe	{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
File created	C:\Windows\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
File created	C:\Windows\{B75BB127-82C9-495b-B576-FF350504C85C}.exe	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
Token: SeIncBasePriorityPrivilege	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe
Token: SeIncBasePriorityPrivilege	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
Token: SeIncBasePriorityPrivilege	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
Token: SeIncBasePriorityPrivilege	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
Token: SeIncBasePriorityPrivilege	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
Token: SeIncBasePriorityPrivilege	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
Token: SeIncBasePriorityPrivilege	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
Token: SeIncBasePriorityPrivilege	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe
Token: SeIncBasePriorityPrivilege	3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
Token: SeIncBasePriorityPrivilege	1964	{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3660	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	85
PID 4196 wrote to memory of 3660	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	85
PID 4196 wrote to memory of 3660	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	85
PID 4196 wrote to memory of 1936	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	86
PID 4196 wrote to memory of 1936	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	86
PID 4196 wrote to memory of 1936	4196	2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe	86
PID 3660 wrote to memory of 716	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	87
PID 3660 wrote to memory of 716	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	87
PID 3660 wrote to memory of 716	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	87
PID 3660 wrote to memory of 3468	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	88
PID 3660 wrote to memory of 3468	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	88
PID 3660 wrote to memory of 3468	3660	{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe	88
PID 716 wrote to memory of 4264	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	91
PID 716 wrote to memory of 4264	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	91
PID 716 wrote to memory of 4264	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	91
PID 716 wrote to memory of 1180	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	92
PID 716 wrote to memory of 1180	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	92
PID 716 wrote to memory of 1180	716	{B75BB127-82C9-495b-B576-FF350504C85C}.exe	92
PID 4264 wrote to memory of 940	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	95
PID 4264 wrote to memory of 940	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	95
PID 4264 wrote to memory of 940	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	95
PID 4264 wrote to memory of 3944	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	96
PID 4264 wrote to memory of 3944	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	96
PID 4264 wrote to memory of 3944	4264	{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe	96
PID 940 wrote to memory of 1012	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	97
PID 940 wrote to memory of 1012	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	97
PID 940 wrote to memory of 1012	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	97
PID 940 wrote to memory of 4544	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	98
PID 940 wrote to memory of 4544	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	98
PID 940 wrote to memory of 4544	940	{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe	98
PID 1012 wrote to memory of 1524	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	99
PID 1012 wrote to memory of 1524	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	99
PID 1012 wrote to memory of 1524	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	99
PID 1012 wrote to memory of 4304	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	100
PID 1012 wrote to memory of 4304	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	100
PID 1012 wrote to memory of 4304	1012	{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe	100
PID 1524 wrote to memory of 1684	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	101
PID 1524 wrote to memory of 1684	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	101
PID 1524 wrote to memory of 1684	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	101
PID 1524 wrote to memory of 1144	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	102
PID 1524 wrote to memory of 1144	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	102
PID 1524 wrote to memory of 1144	1524	{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe	102
PID 1684 wrote to memory of 4992	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	103
PID 1684 wrote to memory of 4992	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	103
PID 1684 wrote to memory of 4992	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	103
PID 1684 wrote to memory of 3172	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	104
PID 1684 wrote to memory of 3172	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	104
PID 1684 wrote to memory of 3172	1684	{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe	104
PID 4992 wrote to memory of 4696	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	105
PID 4992 wrote to memory of 4696	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	105
PID 4992 wrote to memory of 4696	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	105
PID 4992 wrote to memory of 4092	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	106
PID 4992 wrote to memory of 4092	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	106
PID 4992 wrote to memory of 4092	4992	{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe	106
PID 4696 wrote to memory of 3068	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	107
PID 4696 wrote to memory of 3068	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	107
PID 4696 wrote to memory of 3068	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	107
PID 4696 wrote to memory of 2308	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	108
PID 4696 wrote to memory of 2308	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	108
PID 4696 wrote to memory of 2308	4696	{9186A73A-F982-49d2-91F7-53871B58C678}.exe	108
PID 3068 wrote to memory of 1964	3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe	109
PID 3068 wrote to memory of 1964	3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe	109
PID 3068 wrote to memory of 1964	3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe	109
PID 3068 wrote to memory of 1912	3068	{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-08_566b881c0b5202056eea3b88fbb6c50a_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
  C:\Windows\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\{B75BB127-82C9-495b-B576-FF350504C85C}.exe
    C:\Windows\{B75BB127-82C9-495b-B576-FF350504C85C}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Windows\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
      C:\Windows\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Windows\{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
        
        C:\Windows\{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:940
      - C:\Windows\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
        
        C:\Windows\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
        
        C:\Windows\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
        
        C:\Windows\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
        
        C:\Windows\{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\{9186A73A-F982-49d2-91F7-53871B58C678}.exe
        
        C:\Windows\{9186A73A-F982-49d2-91F7-53871B58C678}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
        
        C:\Windows\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
        
        C:\Windows\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe
        
        C:\Windows\{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe
        13⤵
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BD74~1.EXE > nul
        13⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B06BF~1.EXE > nul
        12⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9186A~1.EXE > nul
        11⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1AD9~1.EXE > nul
        10⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1D4D~1.EXE > nul
        9⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1089~1.EXE > nul
        8⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87FD3~1.EXE > nul
        7⤵
        
        PID:4304
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68624~1.EXE > nul
        6⤵
        
        PID:4544
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C76E5~1.EXE > nul
        5⤵
        
        PID:3944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B75BB~1.EXE > nul
      4⤵
      PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{42D01~1.EXE > nul
    3⤵
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3BD74ADC-A713-4f5b-BA98-775F8DAF23BE}.exe

Filesize
192KB

MD5
0dcf718daf37633fcff94b0476ddac66

SHA1
5e3619f520450131a627ab913fa9ae0088f3ecc5

SHA256
0395093f1be093f69b5b1deccdc8cd4653b948dda99332a3a533d327bae512ad

SHA512
fc1592caf16a9f6f813a0323f9d0f29844963fcf50341333b8594dbcbf8da4e1d44089e6106b2845b95c1f3fa9d897d864ed28d0a2b2f1abc49b569fbb0cb6fa

Download Submit
C:\Windows\{42D01F82-D7F1-47fe-B74A-C8AD75C4720A}.exe

Filesize
192KB

MD5
027e8c84add4254481dc8b7e2e935c5e

SHA1
ae9194871a5a118ca4e43324ccce63c4c0505fb0

SHA256
527f3ccfd553325403acefe50ca64a0eab399419d4c02db0d9252fd4fa814297

SHA512
e115ec35069b2cc552a266de81a6f283d9697a72e99e0c990e58b722147b6f0bef2ce54215e75d10eed1df5f34fb9aa4280b668c909a9fac60b4d12f4f182cdd

Download Submit
C:\Windows\{68624463-E74E-4543-A3AD-0D2BB61C504E}.exe

Filesize
192KB

MD5
3fae71e92638b74744a25d52102d678d

SHA1
27e92ac3ea249383e057734002f616b84fd41178

SHA256
92e22925a4d9a5e0603e3771913f139f6b75074b75b5c4b243ecce31a140c50d

SHA512
ce8a871e0eae7a6f0cc16cc944c48f933b44c82a74bc91c41876916670b019ff18bb35f7c95fd36b0032a8c242f5a0d98122deb11b3caaae0d734ca7478c333e

Download Submit
C:\Windows\{87FD3D43-1BE2-46cf-8EFA-3DE9E12FB169}.exe

Filesize
192KB

MD5
4dd54e2e99b63297fc02da39fcc2cfde

SHA1
22c4c360c7a3a59c40097362000965c6dd8bfd10

SHA256
ba73ff3a5997cde1600f3975657ccada823f90407b70a1cafb547afc0e24fb1d

SHA512
04c40dc7102541b807ee096b0024ecbc0daf4760f14392d91cda13c1eee15e6ea1c596b5493e0271ee2fe5d50f18b825d4e4750c4d5720a9705d9528eca145fb

Download Submit
C:\Windows\{9186A73A-F982-49d2-91F7-53871B58C678}.exe

Filesize
192KB

MD5
956e707cb00ffbf3d2adc4b540feffd1

SHA1
ea97304428d36d269c67ae072e5e4cf5b1fc2a59

SHA256
fc705b380cd33679d11e6074b5dacbe51dadd4b98bac711bcff0a3fd13a20e3f

SHA512
a01887c48f1d459957db0b03f4d74ea66d39388dcb5b71b7a789208157b34c4d31de2059a5a5127b4eb4019b87e9e2c90dd54e6194d40e2c7b8b6b619a900878

Download Submit
C:\Windows\{A1089BEB-6772-4ed9-972F-7D0D22EC6000}.exe

Filesize
192KB

MD5
b1bf5b75bcec0e23371079efd7ea1a71

SHA1
133f82204b8c22b1703c18fd2bc37d0f1c433f36

SHA256
4806d3078e91868acb28c716f6591a4b3f2ef26df3a234c46893645134929d76

SHA512
38a9da697be3bb8364bc6fba6b5028ef337878295b2efcfd0885c09f4c7e03930970ee2ba63e26a9abbd767be3561a9964b957736fce0402a33cb413e072fc3d

Download Submit
C:\Windows\{A68F93B3-E930-41c9-9471-93E18A06B72E}.exe

Filesize
192KB

MD5
3fdb17bdaf68153a993ed324803775c4

SHA1
c642e797fbe325424aadf5ae41ea6dc96b34ea7d

SHA256
4572c5a941c365f453041ba42073169e37b60ea5c26f5f4919139c563acca901

SHA512
baa7de75b3c3c963fcd5e7a9ed62b678ff8115a8f789ef571cf18fee016fb886cf7ef460e857445b8e76078ff4ed4f79b6d961cd7b3ceeb7dc0de8d1d2021a7e

Download Submit
C:\Windows\{B06BF50B-FA44-43c9-8210-11C5A02EB2C2}.exe

Filesize
192KB

MD5
bd4caf5979817fd4c0ecf34eb31b86ed

SHA1
3175a56d9939190a8be4ac7cc47c8d6517f4c337

SHA256
71a400cceccd845ffa6166c73b3592bce665651c3c89879e81c9411e0bfcd157

SHA512
970aa036ad0ccbbfbce2abf60d6a11780c9a46aa3bcb12dfc29d2a1fe451c3415650e3f98c905310685983ca6cdba16913b028257389f33ffaac77fb54a8120f

Download Submit
C:\Windows\{B1AD9D3C-7270-413f-8DDB-5327C5017703}.exe

Filesize
192KB

MD5
afb4fa2da6ffe797562daa094239ba4a

SHA1
9013e2268b3da38902081ef213340a87a1253bea

SHA256
f00676d123460e5af75fd18d65e42058337a9c02c3d9203550b2c1c28b2e8466

SHA512
df5a6d17538786f8ed32771d09081105b1727859a63b20901a4fa2bebb1e0f3e804cc394daed3936071e940a6c10254025ce31ab6a0ac2cbb40e2f0f3015a533

Download Submit
C:\Windows\{B75BB127-82C9-495b-B576-FF350504C85C}.exe

Filesize
192KB

MD5
9c66c8fb51207c6c858f5002c521269b

SHA1
c19a0e579ac4d5a65219eb934ed5daa287c5036e

SHA256
8005b5ed914900038cc3f6883324c5c33ed00ca6996ea6c7d96f1b60295da6dd

SHA512
1996734471f5ed0f2dcad845f6c74a95218015f89215389ba5f83038839da4d398a8717995353ae742f9401d16970a87b61c153878136f54eb7fab0169a3f4fe

Download Submit
C:\Windows\{C76E57CC-EBA3-44b0-AE54-99601FC6EC63}.exe

Filesize
192KB

MD5
2c748414dc6c0995c3a7e0759a872a16

SHA1
121bb54d8e64cf5d711a2db82a5f5bf3f88649b8

SHA256
5bac7bbc5f2b3fdc0176cfa8cc76f2f7e65ed102f9aacb076134ab030216794d

SHA512
8d6544f84c32e601105c8a6c39bd5ac006ef340738b021271ccc2f14f01a517cb76583e68d54f4d2e79644cc1ca63ffdc69c6bd09e3010f818a887924290e4ee

Download Submit
C:\Windows\{E1D4DB2A-2F2D-42dd-96BC-82393B3AF874}.exe

Filesize
192KB

MD5
8acb9953a73bda6490dc1ce809abde01

SHA1
724840ffbb73ac2c31651bf685958535eea7b6ae

SHA256
276a56ad45dc7c6b63a041ed62648510ac65cf9517a699bee6dbea6bf4afde98

SHA512
fbca87709cc93c857aad9a0c83bc680b74f7566a1d670534f0079b4731cb52d83e788055f97e90c5cd985e13713771a82f81e8598ea979da06768f3fe669de5e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads