b10af3e4e8baa4781f123559040ffe8974694e0fb64187287d47e1ebf15d36a3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 07:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe
Size

168KB
MD5

7eb1eb56769e01d76f17bdb09fb003a3
SHA1

cd2733d3f637ffe1f757474069a41f70aea1aad7
SHA256

b10af3e4e8baa4781f123559040ffe8974694e0fb64187287d47e1ebf15d36a3
SHA512

087bf93aab5052f0d81156e90282710f9535495f965af412a93763d243904ced9a1fc4e327d5f89e4fa029ce47843b608938665f82ef046954c91210da598fc2
SSDEEP

1536:1EGh0o8lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o8lqOPOe2MUVg3Ve+rX

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{259394FF-4005-4f47-9354-48CB828615A6}\stubpath = "C:\\Windows\\{259394FF-4005-4f47-9354-48CB828615A6}.exe"	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}\stubpath = "C:\\Windows\\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe"	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9A9F478-1E07-497e-911B-7E93A9723300}\stubpath = "C:\\Windows\\{F9A9F478-1E07-497e-911B-7E93A9723300}.exe"	{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}\stubpath = "C:\\Windows\\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe"	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{259394FF-4005-4f47-9354-48CB828615A6}	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}	{259394FF-4005-4f47-9354-48CB828615A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}\stubpath = "C:\\Windows\\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe"	{259394FF-4005-4f47-9354-48CB828615A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}\stubpath = "C:\\Windows\\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe"	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9A9F478-1E07-497e-911B-7E93A9723300}	{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}\stubpath = "C:\\Windows\\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe"	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65600069-E7B9-4c0d-9274-2E76221BF7C7}	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}\stubpath = "C:\\Windows\\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe"	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}\stubpath = "C:\\Windows\\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe"	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65600069-E7B9-4c0d-9274-2E76221BF7C7}\stubpath = "C:\\Windows\\{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe"	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}\stubpath = "C:\\Windows\\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe"	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}\stubpath = "C:\\Windows\\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe"	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe

Executes dropped EXE 12 IoCs

pid	Process
2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
544	{259394FF-4005-4f47-9354-48CB828615A6}.exe
3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
2800	{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
3492	{F9A9F478-1E07-497e-911B-7E93A9723300}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	{259394FF-4005-4f47-9354-48CB828615A6}.exe
File created	C:\Windows\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
File created	C:\Windows\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
File created	C:\Windows\{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
File created	C:\Windows\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
File created	C:\Windows\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
File created	C:\Windows\{F9A9F478-1E07-497e-911B-7E93A9723300}.exe	{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
File created	C:\Windows\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
File created	C:\Windows\{259394FF-4005-4f47-9354-48CB828615A6}.exe	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
File created	C:\Windows\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
File created	C:\Windows\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
File created	C:\Windows\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
Token: SeIncBasePriorityPrivilege	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
Token: SeIncBasePriorityPrivilege	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe
Token: SeIncBasePriorityPrivilege	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
Token: SeIncBasePriorityPrivilege	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
Token: SeIncBasePriorityPrivilege	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
Token: SeIncBasePriorityPrivilege	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
Token: SeIncBasePriorityPrivilege	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
Token: SeIncBasePriorityPrivilege	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
Token: SeIncBasePriorityPrivilege	2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
Token: SeIncBasePriorityPrivilege	2800	{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2208	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	84
PID 2216 wrote to memory of 2208	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	84
PID 2216 wrote to memory of 2208	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	84
PID 2216 wrote to memory of 436	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	85
PID 2216 wrote to memory of 436	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	85
PID 2216 wrote to memory of 436	2216	2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe	85
PID 2208 wrote to memory of 4844	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	86
PID 2208 wrote to memory of 4844	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	86
PID 2208 wrote to memory of 4844	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	86
PID 2208 wrote to memory of 5064	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	87
PID 2208 wrote to memory of 5064	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	87
PID 2208 wrote to memory of 5064	2208	{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe	87
PID 4844 wrote to memory of 544	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	89
PID 4844 wrote to memory of 544	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	89
PID 4844 wrote to memory of 544	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	89
PID 4844 wrote to memory of 4004	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	90
PID 4844 wrote to memory of 4004	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	90
PID 4844 wrote to memory of 4004	4844	{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe	90
PID 544 wrote to memory of 3528	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	91
PID 544 wrote to memory of 3528	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	91
PID 544 wrote to memory of 3528	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	91
PID 544 wrote to memory of 2080	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	92
PID 544 wrote to memory of 2080	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	92
PID 544 wrote to memory of 2080	544	{259394FF-4005-4f47-9354-48CB828615A6}.exe	92
PID 3528 wrote to memory of 1356	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	93
PID 3528 wrote to memory of 1356	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	93
PID 3528 wrote to memory of 1356	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	93
PID 3528 wrote to memory of 1672	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	94
PID 3528 wrote to memory of 1672	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	94
PID 3528 wrote to memory of 1672	3528	{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe	94
PID 1356 wrote to memory of 3604	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	95
PID 1356 wrote to memory of 3604	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	95
PID 1356 wrote to memory of 3604	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	95
PID 1356 wrote to memory of 3524	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	96
PID 1356 wrote to memory of 3524	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	96
PID 1356 wrote to memory of 3524	1356	{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe	96
PID 3604 wrote to memory of 2064	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	97
PID 3604 wrote to memory of 2064	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	97
PID 3604 wrote to memory of 2064	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	97
PID 3604 wrote to memory of 4792	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	98
PID 3604 wrote to memory of 4792	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	98
PID 3604 wrote to memory of 4792	3604	{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe	98
PID 2064 wrote to memory of 2188	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	99
PID 2064 wrote to memory of 2188	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	99
PID 2064 wrote to memory of 2188	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	99
PID 2064 wrote to memory of 3192	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	100
PID 2064 wrote to memory of 3192	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	100
PID 2064 wrote to memory of 3192	2064	{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe	100
PID 2188 wrote to memory of 3012	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	101
PID 2188 wrote to memory of 3012	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	101
PID 2188 wrote to memory of 3012	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	101
PID 2188 wrote to memory of 4248	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	102
PID 2188 wrote to memory of 4248	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	102
PID 2188 wrote to memory of 4248	2188	{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe	102
PID 3012 wrote to memory of 2556	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	103
PID 3012 wrote to memory of 2556	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	103
PID 3012 wrote to memory of 2556	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	103
PID 3012 wrote to memory of 4516	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	104
PID 3012 wrote to memory of 4516	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	104
PID 3012 wrote to memory of 4516	3012	{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe	104
PID 2556 wrote to memory of 2800	2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe	105
PID 2556 wrote to memory of 2800	2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe	105
PID 2556 wrote to memory of 2800	2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe	105
PID 2556 wrote to memory of 4856	2556	{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-10_7eb1eb56769e01d76f17bdb09fb003a3_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
  C:\Windows\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
    C:\Windows\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\{259394FF-4005-4f47-9354-48CB828615A6}.exe
      C:\Windows\{259394FF-4005-4f47-9354-48CB828615A6}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
        
        C:\Windows\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3528
      - C:\Windows\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
        
        C:\Windows\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
        
        C:\Windows\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
        
        C:\Windows\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
        
        C:\Windows\{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
        
        C:\Windows\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
        
        C:\Windows\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
        
        C:\Windows\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
        
        C:\Windows\{F9A9F478-1E07-497e-911B-7E93A9723300}.exe
        
        C:\Windows\{F9A9F478-1E07-497e-911B-7E93A9723300}.exe
        13⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD523~1.EXE > nul
        13⤵
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D254D~1.EXE > nul
        12⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B4FED~1.EXE > nul
        11⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{65600~1.EXE > nul
        10⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2638F~1.EXE > nul
        9⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D284~1.EXE > nul
        8⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81BA5~1.EXE > nul
        7⤵
        
        PID:3524
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94A4C~1.EXE > nul
        6⤵
        
        PID:1672
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25939~1.EXE > nul
        5⤵
        
        PID:2080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E6617~1.EXE > nul
      4⤵
      PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D6AAD~1.EXE > nul
    3⤵
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{259394FF-4005-4f47-9354-48CB828615A6}.exe

Filesize
168KB

MD5
1084833330e302f36bbcf67c2d327d69

SHA1
23f42651a4f19ad477917e326ed7d3da68391cbc

SHA256
f055fc5ab8de848c9e72b1ff441ede78ccb08f0b3c7e9cbddd7d8cbfccd7eda6

SHA512
15d653e17c6fc16e87b63944cea0a1c2d8e6007cad6ab96dfdfa203ce638578b54b0572050ceb698a41e7346bc1d2c17249bcfde61891770d9fc1ab0f40733c0

Download Submit
C:\Windows\{2638FC3D-34EE-4512-8FC3-DB65B927C11C}.exe

Filesize
168KB

MD5
190cc1a48cff48e3dbd524e274ffd113

SHA1
2ad350c2195e06db8618a4206d77b610005c0dd1

SHA256
599a0e72ef3058d7f8a416cde90e8031cc52926a47af5dbd8c898534fc316782

SHA512
61346573afe0057fb047ec1202e624203043687d336107836443b48b40a125ab0a62c4347e1b555eafcebe4aedc56b596581694c8df835cd713ea24f3f5162a7

Download Submit
C:\Windows\{2D284133-5187-4d82-8BF5-5F176ABC4D6E}.exe

Filesize
168KB

MD5
db8cbced03b5ff5260dc611ce5a2fcb3

SHA1
de1b7812a81825dfaed0c202ebbe36412cdefc48

SHA256
4fb0ed0c42cc679e4fc308f315279c32a82641961ca84c040a7ba6f5b28d2565

SHA512
0bf976a07c56d93f8b9b4410e452ca2f0351edcf9c7ca45fc06a140fb1a1e91c90615e38fadcbf3d55abc7e2b63d54ae1aaee789a0a1c0a44cd36f794b02b6f0

Download Submit
C:\Windows\{65600069-E7B9-4c0d-9274-2E76221BF7C7}.exe

Filesize
168KB

MD5
3319d2351ae969ea4c074469244b90b9

SHA1
ed32307f693f3c05cf2ac939cad8f80351a5dbbb

SHA256
7d1652e66c15279fa0bd56d868b257fb87887e8d56039b3820c2bceb3d561e5b

SHA512
725740d73a6a048a72460110f7efd5c9b724597e93cd496b3ddd1947a15d8033bee534bfcd297423314b8084cbf9819f8ff04b68c47fe0dafeacb6ace318b0e4

Download Submit
C:\Windows\{81BA5C2A-99B9-4c0c-83BB-2735B8CE9A34}.exe

Filesize
168KB

MD5
474421e8a2dd1f54fc5b98a262d78333

SHA1
4ebcfe8f01b0032f72178b57e70e0df14ba7e150

SHA256
6f3775a1d56b7cee5e3b4e1d0325f642991d781606875bf04a5290e4e97b3121

SHA512
75cbed577c0c581683ec81c5f514b453429b4edaf356799c137c73abbd7b0a36e5fa30fa4f81039fbd91960311a6c6ab1a792090713878bc1950c8f0ead8d60e

Download Submit
C:\Windows\{94A4C883-F0FA-4bd9-8ED1-80A4856C27B5}.exe

Filesize
168KB

MD5
209a2a4c4b0e7d92ec24f52ed03416d9

SHA1
b17c3318808b2fca21d6bd469e6cb5ffce8a9b3c

SHA256
057b6ceab997bc9df54731e7a7fb1d7c64a696f3d2f8524ff00d4e6e0a2fa502

SHA512
771f0d117e0faefec65fe4fa7a33e33b85b1752dd2b240dfdc11a74c52b117da47af76cd0ac8a9e39140afbb0d74110695fd53de0a1c0dc535d56d14dfe2a5dd

Download Submit
C:\Windows\{B4FEDAE6-7C30-4300-9EEB-D9ADE6242959}.exe

Filesize
168KB

MD5
ddc6ff13c17c3e9625d733b266e71ae2

SHA1
013919bc1b2605a41ea914415f72c1373bb16c7a

SHA256
b60bd0dca0f37abcd1ab4330187bbe95a70bffc5c517306ba49ea18096bc468c

SHA512
dfb843dd2de796e2bef1831ad6d919839e5528ec71bdd3b64e8ccde7becf9eef35ead46708d80165b298c8a49c309b7960f7cd6083ade481def4e16bb1e67363

Download Submit
C:\Windows\{CD523795-5E4A-40a3-A4E9-61F53BE7ACB0}.exe

Filesize
168KB

MD5
a30cf615f5340bd4c9608dcabda308dc

SHA1
4287c30bfb712f129ab27700e759570e987f94d5

SHA256
ff777de4aa9606775d0c2a5190523465b923c8bde773ce5a24d3e3c457e7e60a

SHA512
d8bee36517d499ce9b8d543c1b61c7b52966e5fe9f3d664318a7460252cbc5bf6698386e4245ab2945b7854ef41570e96544cf62b8447199f44f08441a6ccf8d

Download Submit
C:\Windows\{D254DE0E-B44C-4e34-A4BB-3F088EEBE3AA}.exe

Filesize
168KB

MD5
8eb37123bc3277b818c0e8b06dceba9e

SHA1
fb2cea3a4d905c8cd883c1017c9fc555e7ba2422

SHA256
269a25b0e7b956cf177b9ab80531321196c74b5ad86480adb40b547d48b64327

SHA512
e9d23f3339e9bb8fbde741cc82fa2df35bd1a0969a303f3b134e5d01d959ecefc75f6a6d08c745069a8606bffb93bdaa097eccff13eee0ae2bf00063d97baf31

Download Submit
C:\Windows\{D6AAD0C8-34FC-4b58-8B25-05504F3BB576}.exe

Filesize
168KB

MD5
6e4c28775637809b24b70521eda29dcd

SHA1
a020da777fea86ccf0e6607cb35006dab81a3f57

SHA256
877f414842122eed8236bc7ac39fbfa044339a852ed33a790cb20fff1dc526c6

SHA512
c1daf3aac173028dccc500e4ab59f0f35563ad3dbdde10235184a6debeb036f7b187d97ad1b34bf943724ef0cc330d9391db1e0460ebe2348bcd370ac3829a3d

Download Submit
C:\Windows\{E6617D9A-E2B6-42c4-B92B-0F8FAE0927FB}.exe

Filesize
168KB

MD5
b004efd3ec52ac48859c0d4e5d352bef

SHA1
64ee945f36206788395888694d9001210d76b02f

SHA256
8b7a3036b23dd814cf38362b93bb765491fa2b4b09b373e5eb5090664b4b2f16

SHA512
f77b4bbdf681ad83cf2e5927071361b5cbff997b9b8dc947153a32917a2d3ad2fa0f2719c0836c2e4e535c4a5b3ebacb5a375c5f47777814b38dfe657a0f60cd

Download Submit
C:\Windows\{F9A9F478-1E07-497e-911B-7E93A9723300}.exe

Filesize
168KB

MD5
faa489d3dc8562f2639d71d48882e6e6

SHA1
7430cfaa791b62fe25f40ad3222a40fa7a451855

SHA256
eba6bf7d5b09dbfcbf9a59c4fcbed90d487d622b4c8294decedf460d9c823158

SHA512
cfd5d88926da72f6f34898b777ef460ca0bfebff2fcf39f186671234ffec4250eb6ed811ed3431171648c8ac26500923ce2bdaa27096fc18aa5aaef92b473f7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads