a1509c1d8f6aeb4fbb585e7ad22d68917e08bcb7de21dfa6aeb6548e42764c96

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
Size

408KB
MD5

88e501d3d838acdbb20406fab48c7105
SHA1

051eb736bb1f26e3f03fbaea04e1595a91dce3da
SHA256

a1509c1d8f6aeb4fbb585e7ad22d68917e08bcb7de21dfa6aeb6548e42764c96
SHA512

ca2f8e9014c984f5c5c65ca05386de68c52b63fca4207eae796edd806b7fa326ecc3b530d7063e3f2e60bdb6aef82940af57953d2fbe6de74050fa89d5250cff
SSDEEP

3072:CEGh0o1l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGvldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012185-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122ca-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6f8-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000122ca-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000f6f8-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000122ca-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000000f6f8-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00100000000122ca-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f8-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00110000000122ca-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f8-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}\stubpath = "C:\\Windows\\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe"	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50482A88-EB3A-4488-957D-F2F694D59A0B}\stubpath = "C:\\Windows\\{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe"	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87656994-1188-4163-8066-817C554576A0}\stubpath = "C:\\Windows\\{87656994-1188-4163-8066-817C554576A0}.exe"	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37D229DB-5ED8-4119-A5D8-C895E3970076}\stubpath = "C:\\Windows\\{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe"	{87656994-1188-4163-8066-817C554576A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}\stubpath = "C:\\Windows\\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe"	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50482A88-EB3A-4488-957D-F2F694D59A0B}	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9679E5F5-B8B2-410f-997D-D0920897BF8A}\stubpath = "C:\\Windows\\{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe"	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{87656994-1188-4163-8066-817C554576A0}	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}	{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}\stubpath = "C:\\Windows\\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe"	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}\stubpath = "C:\\Windows\\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe"	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37D229DB-5ED8-4119-A5D8-C895E3970076}	{87656994-1188-4163-8066-817C554576A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5B6E1ED-825E-4629-A227-F3C55C908036}	{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5B6E1ED-825E-4629-A227-F3C55C908036}\stubpath = "C:\\Windows\\{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe"	{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}\stubpath = "C:\\Windows\\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe"	{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9679E5F5-B8B2-410f-997D-D0920897BF8A}	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}\stubpath = "C:\\Windows\\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe"	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe

Deletes itself 1 IoCs

pid	Process
2772	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
1104	{87656994-1188-4163-8066-817C554576A0}.exe
1836	{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
2956	{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
2320	{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe	{87656994-1188-4163-8066-817C554576A0}.exe
File created	C:\Windows\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
File created	C:\Windows\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
File created	C:\Windows\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
File created	C:\Windows\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
File created	C:\Windows\{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe	{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
File created	C:\Windows\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe	{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
File created	C:\Windows\{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
File created	C:\Windows\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
File created	C:\Windows\{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
File created	C:\Windows\{87656994-1188-4163-8066-817C554576A0}.exe	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
Token: SeIncBasePriorityPrivilege	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
Token: SeIncBasePriorityPrivilege	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
Token: SeIncBasePriorityPrivilege	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
Token: SeIncBasePriorityPrivilege	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
Token: SeIncBasePriorityPrivilege	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
Token: SeIncBasePriorityPrivilege	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
Token: SeIncBasePriorityPrivilege	1104	{87656994-1188-4163-8066-817C554576A0}.exe
Token: SeIncBasePriorityPrivilege	1836	{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
Token: SeIncBasePriorityPrivilege	2956	{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2788	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	28
PID 2656 wrote to memory of 2788	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	28
PID 2656 wrote to memory of 2788	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	28
PID 2656 wrote to memory of 2788	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	28
PID 2656 wrote to memory of 2772	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	29
PID 2656 wrote to memory of 2772	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	29
PID 2656 wrote to memory of 2772	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	29
PID 2656 wrote to memory of 2772	2656	2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe	29
PID 2788 wrote to memory of 2852	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	30
PID 2788 wrote to memory of 2852	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	30
PID 2788 wrote to memory of 2852	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	30
PID 2788 wrote to memory of 2852	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	30
PID 2788 wrote to memory of 2744	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	31
PID 2788 wrote to memory of 2744	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	31
PID 2788 wrote to memory of 2744	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	31
PID 2788 wrote to memory of 2744	2788	{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe	31
PID 2852 wrote to memory of 3012	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	35
PID 2852 wrote to memory of 3012	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	35
PID 2852 wrote to memory of 3012	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	35
PID 2852 wrote to memory of 3012	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	35
PID 2852 wrote to memory of 3024	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	34
PID 2852 wrote to memory of 3024	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	34
PID 2852 wrote to memory of 3024	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	34
PID 2852 wrote to memory of 3024	2852	{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe	34
PID 3012 wrote to memory of 704	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	37
PID 3012 wrote to memory of 704	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	37
PID 3012 wrote to memory of 704	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	37
PID 3012 wrote to memory of 704	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	37
PID 3012 wrote to memory of 240	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	36
PID 3012 wrote to memory of 240	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	36
PID 3012 wrote to memory of 240	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	36
PID 3012 wrote to memory of 240	3012	{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe	36
PID 704 wrote to memory of 2632	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	39
PID 704 wrote to memory of 2632	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	39
PID 704 wrote to memory of 2632	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	39
PID 704 wrote to memory of 2632	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	39
PID 704 wrote to memory of 2816	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	38
PID 704 wrote to memory of 2816	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	38
PID 704 wrote to memory of 2816	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	38
PID 704 wrote to memory of 2816	704	{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe	38
PID 2632 wrote to memory of 2152	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	41
PID 2632 wrote to memory of 2152	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	41
PID 2632 wrote to memory of 2152	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	41
PID 2632 wrote to memory of 2152	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	41
PID 2632 wrote to memory of 1972	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	40
PID 2632 wrote to memory of 1972	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	40
PID 2632 wrote to memory of 1972	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	40
PID 2632 wrote to memory of 1972	2632	{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe	40
PID 2152 wrote to memory of 2156	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	43
PID 2152 wrote to memory of 2156	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	43
PID 2152 wrote to memory of 2156	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	43
PID 2152 wrote to memory of 2156	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	43
PID 2152 wrote to memory of 1596	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	42
PID 2152 wrote to memory of 1596	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	42
PID 2152 wrote to memory of 1596	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	42
PID 2152 wrote to memory of 1596	2152	{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe	42
PID 2156 wrote to memory of 1104	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	45
PID 2156 wrote to memory of 1104	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	45
PID 2156 wrote to memory of 1104	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	45
PID 2156 wrote to memory of 1104	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	45
PID 2156 wrote to memory of 1924	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	44
PID 2156 wrote to memory of 1924	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	44
PID 2156 wrote to memory of 1924	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	44
PID 2156 wrote to memory of 1924	2156	{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_88e501d3d838acdbb20406fab48c7105_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
  C:\Windows\{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
    C:\Windows\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AD8A9~1.EXE > nul
      4⤵
      PID:3024
  - - C:\Windows\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
      C:\Windows\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB730~1.EXE > nul
        5⤵
        
        PID:240
    - - C:\Windows\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
        
        C:\Windows\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:704
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B381C~1.EXE > nul
        6⤵
        
        PID:2816
      - C:\Windows\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
        
        C:\Windows\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D80C1~1.EXE > nul
        7⤵
        
        PID:1972
        
        C:\Windows\{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
        
        C:\Windows\{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50482~1.EXE > nul
        8⤵
        
        PID:1596
        
        C:\Windows\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
        
        C:\Windows\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5EC5E~1.EXE > nul
        9⤵
        
        PID:1924
        
        C:\Windows\{87656994-1188-4163-8066-817C554576A0}.exe
        
        C:\Windows\{87656994-1188-4163-8066-817C554576A0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{87656~1.EXE > nul
        10⤵
        
        PID:2252
        
        C:\Windows\{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
        
        C:\Windows\{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
        
        C:\Windows\{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5B6E~1.EXE > nul
        12⤵
        
        PID:2276
        
        C:\Windows\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe
        
        C:\Windows\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe
        12⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37D22~1.EXE > nul
        11⤵
        
        PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9679E~1.EXE > nul
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{37D229DB-5ED8-4119-A5D8-C895E3970076}.exe

Filesize
408KB

MD5
82820eae01ba173b571fff5ac3de7eb0

SHA1
392eac2c75d6a1e6b73eecf3fce9c5d6bca8097b

SHA256
27ebb10c2dd8aec5ba8347244d98fa19245d8da987946c97d7e9d33e78dcafa1

SHA512
4b9d0baa35e549ae8165d98f183da729a3e1150d157ed91508d1e697f5e1adf2a9221ea11ff68c6a5570f841a6f4a692bd108a275d42641fb69925cb77a43dbc

Download Submit
C:\Windows\{50482A88-EB3A-4488-957D-F2F694D59A0B}.exe

Filesize
408KB

MD5
064125ae2a24004effeea589f2cf9fb7

SHA1
2d29aeec8533919bef827e19488fcfe1827c13ad

SHA256
034d83b18e149bc0010fb0a6e48a94e63c268bf185d8f04ac1ac4894d64ad290

SHA512
525116227e321207c0ba7e4acc4c5491be1ef58451d40b2b94f87cf5a21538fb3aa7994a948ff1688b8a9099e5a89b0f579667d58a55ea8a552b5913c42c0921

Download Submit
C:\Windows\{5EC5E177-BD82-47c2-9AA5-66C1C22EFBEE}.exe

Filesize
408KB

MD5
e8d169d971f6769bd18dd7a081438279

SHA1
c557a46a0f0ad3f4e46f085d68855b909d30d3d0

SHA256
296b80098826902fe9d4e09cc396743260d266b91a0d26ae6df07b97f80b51f9

SHA512
6181747f499544e47412648754bd156df205d3441a3b24aae373b9a33f434ef3c812200bd5c4adc61416c498fb2ce18e1546ef3ee3aa74ea227a2efea8f9ed75

Download Submit
C:\Windows\{87656994-1188-4163-8066-817C554576A0}.exe

Filesize
408KB

MD5
4f62aaacb2c95bdf1ebceeeb523a0821

SHA1
f5db13544f173bc0c2f1ee6303a06367efa97d06

SHA256
a06b5c957f3b0d0386047bdfa1654caa39f0f2419f823ae23765fabe463b480b

SHA512
a370aabe346c51f30278743f77e00fe4241597a8c200704f744d4319b245e4f429decb7fb9671dcee2c49cd0f23176c2b5a709165c5e180ffda4b4fcc82808cb

Download Submit
C:\Windows\{9679E5F5-B8B2-410f-997D-D0920897BF8A}.exe

Filesize
408KB

MD5
7cc1290e1f83b7f50f5a87739d720747

SHA1
375e99969801417045e42ec4de49e9a33181ea5e

SHA256
088875731d9d5baf80bae99db798e0177a32e85c11e73a97fff7e3545e416fec

SHA512
7145952c8f5cb87f6c067b19dd8552e01573c73f79f8ce470e8469418059d7c4c8ea7302a0b6aab2f443c82b2a4a8a3375626285d16e5048f60d302b5500e49b

Download Submit
C:\Windows\{A11D368F-11E8-4be4-BEB2-1579EC3A20A5}.exe

Filesize
408KB

MD5
80e10dd3258dcba9319f8cbdcc98b8a0

SHA1
6008a953f50f58e07dfd1d775969cd7814affadf

SHA256
50815b651146f9b1d1392e54371d084c1d94ffff017fab35c73cdf2efc8bf4ba

SHA512
68339338eab5edcfe1ca4a641b1bcbda2108daf72b6d6e9bb7839d825e354ba840db68ea11cda2c1f9723fc5cf6d89d7340f2abde4316ddb059a05258bc03051

Download Submit
C:\Windows\{A5B6E1ED-825E-4629-A227-F3C55C908036}.exe

Filesize
408KB

MD5
8db94d1d6099d6a778aa684328d9958d

SHA1
6006b2e8b305aa4c68e9e15c3373f03d5cca4683

SHA256
1919823a3519e60e3f5b1027b50418b8916bb4a4b552f769bd9f225add57c268

SHA512
76cb9b43d71c4cda1fb81952bce509d1e3eb3dad4f07cb84f0d42ff9337929373cfc6273bb7adc8668f6c85951bdfb5ef7f16765d0c61ca76299edf22a1dfdbe

Download Submit
C:\Windows\{AD8A94F2-1B66-414c-B8DE-8465D81BF0D6}.exe

Filesize
408KB

MD5
9b4a954be855280bba8d9d021ab7be1d

SHA1
85f7e1c15274f02d5ff261d36c9ff124e2217864

SHA256
ed4e7cb932929b2eb13ee68121c08feeb6d2d5c60eb0002d0ee28926f5de6fd6

SHA512
d5e853af911fcb3e30eaa2f2011d46e9a153493cd75462bb9e70ad35b9ba967706d57aaae8cb2e0f71acc874afa376f8d2ba1c6ca82467889210a82a8c58c259

Download Submit
C:\Windows\{B381CA60-AFE0-45f4-ABF7-A32CF2DF1995}.exe

Filesize
408KB

MD5
435dd135088db8e4c08cffc7d216638b

SHA1
6559a7bcfa9250bc132f3eed579a4e2dfe647330

SHA256
0c3dca2e17789aa15634bbf4487d1b2ce7d7de4e9eabde81a5702810e26a601c

SHA512
e0efbfe5104d18da9bfa40aee0f9b6e7811669a18b3cb3aac66cb0d82f955051be9a86cab7e38bcc7efe7b9e54808dea81bb9f0f0cc5de973ab0ce51d6ff8fd3

Download Submit
C:\Windows\{D80C1C35-A883-49bc-8C52-F9E78B48BF2D}.exe

Filesize
408KB

MD5
135d4b188b7421203bd6e327e2e428a8

SHA1
c168bd53c3e0e53c97e04f2f01fa1db69b4dd1be

SHA256
d9c74840f43d4e3fad6905d31c18c7b157fc9f9afe7f4bea9e69755f95db7630

SHA512
ab22229f5111094b3d65ea5d6b3dd5e82f83a79c25f475c76714d5f2565f0949cce2a69cb235ff69ee4fc4b964c0e7facb0b99edc7e2a012a09d96d27c872c22

Download Submit
C:\Windows\{DB7306CD-5644-4eaf-AC1F-B48BC5C82013}.exe

Filesize
408KB

MD5
7859feb8f68e8f8fc7d258091cf68689

SHA1
337676d17f01e220200732bf6cb858ee1d44229a

SHA256
2dc7381180994d8b238b258b4ba3d088289197e626576952333a42b1e2b04481

SHA512
aec0b00098e448bf28f623990c3a595781299dd35945f02cf8966dc99c76efc1dee8ca68bb13b2bf2cb4f3189102f3afa1ce5345299c997ad4b4701be4dff3e6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads