fd2971c2dcd1c5999150f3eb288aa9f3386c48e1abe6c07a23be6f1317dea5f8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
Size

408KB
MD5

c13919e5d273245b567763c2b456a091
SHA1

fe956bc2c82199d5163fb2ecb3352efeec827f41
SHA256

fd2971c2dcd1c5999150f3eb288aa9f3386c48e1abe6c07a23be6f1317dea5f8
SHA512

cffad9f174a7585c81618b3e72d62aee8d8940b0aa55333f39baa6ce60e3242422ed9222dd67b04828f710df38c6cd793e65edc882ff1a8a955a843049c44003
SSDEEP

3072:CEGh0oEl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGildOe2MUVg3vTeKcAEciTBqr3jy9

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37699CCF-AE44-4f03-B758-2CB89727DBA4}\stubpath = "C:\\Windows\\{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe"	{4769925F-C77B-457f-896F-282E30AF0633}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}	{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}\stubpath = "C:\\Windows\\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe"	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}\stubpath = "C:\\Windows\\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe"	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37699CCF-AE44-4f03-B758-2CB89727DBA4}	{4769925F-C77B-457f-896F-282E30AF0633}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421EFD46-06D8-41fc-9F59-91FC337BBB73}	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}\stubpath = "C:\\Windows\\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe"	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4769925F-C77B-457f-896F-282E30AF0633}	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}\stubpath = "C:\\Windows\\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe"	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421EFD46-06D8-41fc-9F59-91FC337BBB73}\stubpath = "C:\\Windows\\{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe"	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}\stubpath = "C:\\Windows\\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe"	{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{003CCA33-83F9-4468-9D73-348DD4C65F6F}	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4769925F-C77B-457f-896F-282E30AF0633}\stubpath = "C:\\Windows\\{4769925F-C77B-457f-896F-282E30AF0633}.exe"	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}\stubpath = "C:\\Windows\\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe"	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}\stubpath = "C:\\Windows\\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe"	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{003CCA33-83F9-4468-9D73-348DD4C65F6F}\stubpath = "C:\\Windows\\{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe"	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}\stubpath = "C:\\Windows\\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe"	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe

Executes dropped EXE 12 IoCs

pid	Process
2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe
1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
4188	{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
4660	{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
File created	C:\Windows\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
File created	C:\Windows\{4769925F-C77B-457f-896F-282E30AF0633}.exe	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
File created	C:\Windows\{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
File created	C:\Windows\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
File created	C:\Windows\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe	{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
File created	C:\Windows\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
File created	C:\Windows\{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	{4769925F-C77B-457f-896F-282E30AF0633}.exe
File created	C:\Windows\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
File created	C:\Windows\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
File created	C:\Windows\{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
File created	C:\Windows\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
Token: SeIncBasePriorityPrivilege	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
Token: SeIncBasePriorityPrivilege	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
Token: SeIncBasePriorityPrivilege	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe
Token: SeIncBasePriorityPrivilege	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
Token: SeIncBasePriorityPrivilege	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
Token: SeIncBasePriorityPrivilege	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
Token: SeIncBasePriorityPrivilege	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
Token: SeIncBasePriorityPrivilege	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
Token: SeIncBasePriorityPrivilege	5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
Token: SeIncBasePriorityPrivilege	4188	{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2224	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	94
PID 4984 wrote to memory of 2224	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	94
PID 4984 wrote to memory of 2224	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	94
PID 4984 wrote to memory of 2584	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	95
PID 4984 wrote to memory of 2584	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	95
PID 4984 wrote to memory of 2584	4984	2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe	95
PID 2224 wrote to memory of 1140	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	96
PID 2224 wrote to memory of 1140	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	96
PID 2224 wrote to memory of 1140	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	96
PID 2224 wrote to memory of 2700	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	97
PID 2224 wrote to memory of 2700	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	97
PID 2224 wrote to memory of 2700	2224	{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe	97
PID 1140 wrote to memory of 2472	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	101
PID 1140 wrote to memory of 2472	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	101
PID 1140 wrote to memory of 2472	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	101
PID 1140 wrote to memory of 3804	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	102
PID 1140 wrote to memory of 3804	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	102
PID 1140 wrote to memory of 3804	1140	{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe	102
PID 2472 wrote to memory of 4304	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	103
PID 2472 wrote to memory of 4304	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	103
PID 2472 wrote to memory of 4304	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	103
PID 2472 wrote to memory of 4364	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	104
PID 2472 wrote to memory of 4364	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	104
PID 2472 wrote to memory of 4364	2472	{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe	104
PID 4304 wrote to memory of 1776	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	105
PID 4304 wrote to memory of 1776	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	105
PID 4304 wrote to memory of 1776	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	105
PID 4304 wrote to memory of 2948	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	106
PID 4304 wrote to memory of 2948	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	106
PID 4304 wrote to memory of 2948	4304	{4769925F-C77B-457f-896F-282E30AF0633}.exe	106
PID 1776 wrote to memory of 560	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	108
PID 1776 wrote to memory of 560	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	108
PID 1776 wrote to memory of 560	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	108
PID 1776 wrote to memory of 4328	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	109
PID 1776 wrote to memory of 4328	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	109
PID 1776 wrote to memory of 4328	1776	{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe	109
PID 560 wrote to memory of 2988	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	110
PID 560 wrote to memory of 2988	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	110
PID 560 wrote to memory of 2988	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	110
PID 560 wrote to memory of 2364	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	111
PID 560 wrote to memory of 2364	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	111
PID 560 wrote to memory of 2364	560	{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe	111
PID 2988 wrote to memory of 2840	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	115
PID 2988 wrote to memory of 2840	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	115
PID 2988 wrote to memory of 2840	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	115
PID 2988 wrote to memory of 3744	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	116
PID 2988 wrote to memory of 3744	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	116
PID 2988 wrote to memory of 3744	2988	{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe	116
PID 2840 wrote to memory of 2632	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	122
PID 2840 wrote to memory of 2632	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	122
PID 2840 wrote to memory of 2632	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	122
PID 2840 wrote to memory of 2740	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	123
PID 2840 wrote to memory of 2740	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	123
PID 2840 wrote to memory of 2740	2840	{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe	123
PID 2632 wrote to memory of 5044	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	124
PID 2632 wrote to memory of 5044	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	124
PID 2632 wrote to memory of 5044	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	124
PID 2632 wrote to memory of 4512	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	125
PID 2632 wrote to memory of 4512	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	125
PID 2632 wrote to memory of 4512	2632	{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe	125
PID 5044 wrote to memory of 4188	5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe	129
PID 5044 wrote to memory of 4188	5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe	129
PID 5044 wrote to memory of 4188	5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe	129
PID 5044 wrote to memory of 2464	5044	{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe	130

C:\Users\Admin\AppData\Local\Temp\2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-22_c13919e5d273245b567763c2b456a091_goldeneye.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
  C:\Windows\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
    C:\Windows\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
      C:\Windows\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Windows\{4769925F-C77B-457f-896F-282E30AF0633}.exe
        
        C:\Windows\{4769925F-C77B-457f-896F-282E30AF0633}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
      - C:\Windows\{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
        
        C:\Windows\{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
        
        C:\Windows\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
        
        C:\Windows\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
        
        C:\Windows\{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
        
        C:\Windows\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
        
        C:\Windows\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
        
        C:\Windows\{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe
        
        C:\Windows\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe
        13⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{421EF~1.EXE > nul
        13⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F5D2~1.EXE > nul
        12⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6278D~1.EXE > nul
        11⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{003CC~1.EXE > nul
        10⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7300B~1.EXE > nul
        9⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1ACB3~1.EXE > nul
        8⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37699~1.EXE > nul
        7⤵
        
        PID:4328
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{47699~1.EXE > nul
        6⤵
        
        PID:2948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A6C6~1.EXE > nul
        5⤵
        
        PID:4364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{459A7~1.EXE > nul
      4⤵
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{64340~1.EXE > nul
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{003CCA33-83F9-4468-9D73-348DD4C65F6F}.exe

Filesize
408KB

MD5
7cd6ad2ef969ffcdc7f7e52030616bd6

SHA1
9d18382a2c7068618876e4bb91ab2117ff393292

SHA256
8c59bdc23448391baa655d65632ed1a316f2baac62ffb2466fda17435e2c0b29

SHA512
caf96e2abf4023420a7b0176b914901b54ace45087f59b7999a5acf6602572a2f04617c5465c2619d06b6eeb95256d9f4fdb89970c1dfce77a0fa817fb1be9bd

Download Submit
C:\Windows\{0A6C6515-EEAD-4ce1-86BE-05E48A81633F}.exe

Filesize
408KB

MD5
a8564bea34340a710acf168ccde31485

SHA1
e3fcd05057ac562749ca46864274313c1c4757e8

SHA256
a8c86648d1f5514f2ee5c0a18ce37ce2fe7e21ebffb5c80c32639630a7a1e50c

SHA512
53d5fff0510ffa8c231d728140852e297bf7ece4d6eec7338f245186f26da34f20c8c296259d4edf9d9d7f6507c78a89b8503338a446d3ba7268a215fc246eed

Download Submit
C:\Windows\{1ACB330B-E1AF-4566-B68C-F0CD5E73338E}.exe

Filesize
408KB

MD5
03e85696eba7ae7b39c3a79f9c9e39f3

SHA1
ec0084b744fd138b9706f1b45b315e236b6d3220

SHA256
266f96e888b9b6a305cc26ac4ffa7e8090823480f7508ff0af8801be5ad49ec0

SHA512
f8a91926693dd51f109c2f28196354386b5507a88c47ca9216a18cf61112f2d321da70216c376f46609cf94b77b683a202787d465cd8a0bee1330e4b12a6b8d4

Download Submit
C:\Windows\{37699CCF-AE44-4f03-B758-2CB89727DBA4}.exe

Filesize
408KB

MD5
184caf7e3a4371622fbb7963d491dc2e

SHA1
02bfee8731989107090d1d00244d82cfcd30e9cf

SHA256
78c0d2c5c39545fda6cd4ea71deb5030ff269eaabf701e8d4de20949cc779cca

SHA512
257105843e64145a621b224552ef1a5e3fd1518b437eee1ab43f9156c17aea4cfb7d0246324d131af51e8b4859760279459bc5b9c82824bd03f3a9faaf6f23b5

Download Submit
C:\Windows\{421EFD46-06D8-41fc-9F59-91FC337BBB73}.exe

Filesize
408KB

MD5
c9d49c84f083576a2a357047f25d8ffb

SHA1
2d39c0811d94361894d56c566dde39300425ebe7

SHA256
d04581aca3a30af736c13a3ba440f47719b7a5a11478fc536a9f4b4d54dad6b1

SHA512
52b89f49c65f434a8483ef78da0376b4f6b98a197d8d51536773797f568c964773a6b68993a3f6d716589ec787f8bec8178b7b5922e35dde89128ef0e3cb92cd

Download Submit
C:\Windows\{459A7F4A-A6E9-4062-AAF2-031FE54E3C43}.exe

Filesize
408KB

MD5
d0e4e19c9c6594ba9f25a57e13c8ec1e

SHA1
dd37afd839303e247c20d00da251632a67608c76

SHA256
27933648507af756c14b9e9b3782905b6a7c1cb7289c7d0bdd11b46c294d8304

SHA512
490c1b7dc76a1383440c08b1fddc6fc987a14f02317b53fa80b89e54bc530c65bcf5645657610b6fc057dffe6d014cacfdc2872572d04b41425330797ff75335

Download Submit
C:\Windows\{4769925F-C77B-457f-896F-282E30AF0633}.exe

Filesize
408KB

MD5
1434dfc752bee7a890524a555899262a

SHA1
3301a6ca419ebf14036d4ecc58efd4dcd3b01b33

SHA256
94685a5bfdd6b534609d25749c5bf645d0cb04cc8981a0a43e8c25c9d5e45ab1

SHA512
4ccb71a75123159be6392ac68ae58e6b1d8bdc32005f1552d501985dda9c4dfbe4b212954e9b527488af1e97fd922b0a7a83a99be43370e13e644596cccb162e

Download Submit
C:\Windows\{4F5D2F7D-DDDC-4172-B4DA-7E39BAF505D5}.exe

Filesize
408KB

MD5
ed3edb03b1125f70711197b982fe8531

SHA1
4ff95e9f274d09f42bd8ef19ef4aa52767d5cfbf

SHA256
bd59a51dcad06fa6bcb98f2ab7af18c5550014e13a9f852b328267f6275f4ffc

SHA512
fa31ba1101ba908e8c4e9b23dae0f82092cb7dddc3b37dd24e25a5b0ad9a9bdca31dfc1ffff74acba7605289a81bace7ea17ed078045377a74289c3154900c07

Download Submit
C:\Windows\{6278DCB4-CA70-4779-B0AF-5600BAB54B53}.exe

Filesize
408KB

MD5
92ae5e3d1d2f6c194c8db8f7614e67f1

SHA1
3aaae97181a3b9ce0a7d0a7676c9132a32075e48

SHA256
cf95ea1b4133a68256dc98008ad295ea0f15484d0923820c54db26d8c5ad38d2

SHA512
c620cada370aa3069b0f63ef6bafc6cb593451ae149cb1ba7aeb6d1439fd33abe35adcdcbe0fe03b485f13b37a7d036db4ba4b0003c76677f58042c6a7e6dc1d

Download Submit
C:\Windows\{64340181-9A9E-42a2-A7AF-E4C7D4E8B773}.exe

Filesize
408KB

MD5
77fe662e5067cc3509cc2fa5ea27633e

SHA1
a267c3420c4bfc01199dbdb4bae45b8081317240

SHA256
debe218084c788dde42493b32518825cb790c01facb30f334e053e4b7afbee26

SHA512
5b2d96253b9d0a7dd7274c9036ecf21cc3c1be61ad62b1dee8c05cc406b8e6c7fb4505981752eb1b642713d7c0c754231ad46500814b35777212c4843792e768

Download Submit
C:\Windows\{6BF51A4F-050D-43c2-B399-1228F1C11DE3}.exe

Filesize
408KB

MD5
a499177579a5d67122562dee5938f694

SHA1
b0b82e22de1f33ae0d2b0303a34e84df854ae5c5

SHA256
22ff3c4141dc7b6cf59e6cc163d72c8e7df773fe5069f1fb78ab2d727f52f83b

SHA512
559ca02e3f7e842c4a1c94f51fb5f6680e823e1dfd4520e0436445ae67214c05696eb921efd74b0e983db68fce4e0318774d40088c4b0bf07dad06169009b8b5

Download Submit
C:\Windows\{7300BB2C-8B1F-4cab-B0F8-938CD96EF72F}.exe

Filesize
408KB

MD5
7e0654cec764c5ac3bf1f6ec65253bd5

SHA1
4ecc0e2a4cd9343626d723f8d61af999e082a53c

SHA256
c1d7f969d55bf5481aa6a0bdbcdbbf4bdb61c1491489f94ad93f60cdba61af02

SHA512
4da9ab601c82bb433fe32857711704cc7cd1fdb2c540a5c3c140f22c63885b495ce3557bc803cdfefc4b52438a9d1ba5def68e96ebf14ce46ceddbf12334051c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads