124c54a56eb0a69be4b06daaba4400ec84af1aabec10bf4ffc72286ab40e7580

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
Size

408KB
MD5

e2943c3c0ba3f317bf5cad2bfea901e1
SHA1

10dfb5ccc57047c316a14b31a36c7a73560fdb7b
SHA256

124c54a56eb0a69be4b06daaba4400ec84af1aabec10bf4ffc72286ab40e7580
SHA512

493d5ebb1b6e6b33248cddee2618adb94af8a83d93516c9b1ba25a924a2cd2cd269a27710d9dd6710d3021e8ecb559a5eaec94bd6cc265ce82d243330eadfdee
SSDEEP

3072:CEGh0oWl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 10 IoCs

resource	yara_rule
behavioral2/files/0x0003000000022718-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023127-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000002320d-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023127-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000021d92-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021d93-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000021d92-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A37947E6-8DF7-428f-8728-EC4A678D8578}	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A37947E6-8DF7-428f-8728-EC4A678D8578}\stubpath = "C:\\Windows\\{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe"	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D90A769B-7212-4896-86FE-EB14A828CD02}\stubpath = "C:\\Windows\\{D90A769B-7212-4896-86FE-EB14A828CD02}.exe"	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}	{256D2D70-3396-4e6e-9289-999722760E6B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}\stubpath = "C:\\Windows\\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe"	{256D2D70-3396-4e6e-9289-999722760E6B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48282C43-D0F1-4083-8F94-BC024D5C256F}\stubpath = "C:\\Windows\\{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe"	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{256D2D70-3396-4e6e-9289-999722760E6B}\stubpath = "C:\\Windows\\{256D2D70-3396-4e6e-9289-999722760E6B}.exe"	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2E0E18E-4D65-471a-A628-62E11559FF14}\stubpath = "C:\\Windows\\{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe"	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}\stubpath = "C:\\Windows\\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe"	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2E0E18E-4D65-471a-A628-62E11559FF14}	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}\stubpath = "C:\\Windows\\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe"	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}\stubpath = "C:\\Windows\\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe"	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}	{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D90A769B-7212-4896-86FE-EB14A828CD02}	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48282C43-D0F1-4083-8F94-BC024D5C256F}	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{256D2D70-3396-4e6e-9289-999722760E6B}	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}\stubpath = "C:\\Windows\\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe"	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}\stubpath = "C:\\Windows\\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}.exe"	{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe

Executes dropped EXE 10 IoCs

pid	Process
244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe
856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
4944	{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
File created	C:\Windows\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	{256D2D70-3396-4e6e-9289-999722760E6B}.exe
File created	C:\Windows\{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
File created	C:\Windows\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
File created	C:\Windows\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}.exe	{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe
File created	C:\Windows\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
File created	C:\Windows\{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
File created	C:\Windows\{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
File created	C:\Windows\{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
File created	C:\Windows\{256D2D70-3396-4e6e-9289-999722760E6B}.exe	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
File created	C:\Windows\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
Token: SeIncBasePriorityPrivilege	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
Token: SeIncBasePriorityPrivilege	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
Token: SeIncBasePriorityPrivilege	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
Token: SeIncBasePriorityPrivilege	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
Token: SeIncBasePriorityPrivilege	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe
Token: SeIncBasePriorityPrivilege	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
Token: SeIncBasePriorityPrivilege	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
Token: SeIncBasePriorityPrivilege	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
Token: SeIncBasePriorityPrivilege	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 244	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	88
PID 2060 wrote to memory of 244	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	88
PID 2060 wrote to memory of 244	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	88
PID 2060 wrote to memory of 4416	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	89
PID 2060 wrote to memory of 4416	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	89
PID 2060 wrote to memory of 4416	2060	2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe	89
PID 244 wrote to memory of 1156	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	95
PID 244 wrote to memory of 1156	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	95
PID 244 wrote to memory of 1156	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	95
PID 244 wrote to memory of 3376	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	94
PID 244 wrote to memory of 3376	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	94
PID 244 wrote to memory of 3376	244	{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe	94
PID 1156 wrote to memory of 2076	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	100
PID 1156 wrote to memory of 2076	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	100
PID 1156 wrote to memory of 2076	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	100
PID 1156 wrote to memory of 2816	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	99
PID 1156 wrote to memory of 2816	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	99
PID 1156 wrote to memory of 2816	1156	{D90A769B-7212-4896-86FE-EB14A828CD02}.exe	99
PID 2076 wrote to memory of 652	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	102
PID 2076 wrote to memory of 652	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	102
PID 2076 wrote to memory of 652	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	102
PID 2076 wrote to memory of 1000	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	103
PID 2076 wrote to memory of 1000	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	103
PID 2076 wrote to memory of 1000	2076	{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe	103
PID 652 wrote to memory of 2448	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	104
PID 652 wrote to memory of 2448	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	104
PID 652 wrote to memory of 2448	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	104
PID 652 wrote to memory of 512	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	105
PID 652 wrote to memory of 512	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	105
PID 652 wrote to memory of 512	652	{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe	105
PID 2448 wrote to memory of 856	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	106
PID 2448 wrote to memory of 856	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	106
PID 2448 wrote to memory of 856	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	106
PID 2448 wrote to memory of 636	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	107
PID 2448 wrote to memory of 636	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	107
PID 2448 wrote to memory of 636	2448	{256D2D70-3396-4e6e-9289-999722760E6B}.exe	107
PID 856 wrote to memory of 2436	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	108
PID 856 wrote to memory of 2436	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	108
PID 856 wrote to memory of 2436	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	108
PID 856 wrote to memory of 3804	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	109
PID 856 wrote to memory of 3804	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	109
PID 856 wrote to memory of 3804	856	{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe	109
PID 2436 wrote to memory of 4752	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	110
PID 2436 wrote to memory of 4752	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	110
PID 2436 wrote to memory of 4752	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	110
PID 2436 wrote to memory of 4600	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	111
PID 2436 wrote to memory of 4600	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	111
PID 2436 wrote to memory of 4600	2436	{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe	111
PID 4752 wrote to memory of 4336	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	112
PID 4752 wrote to memory of 4336	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	112
PID 4752 wrote to memory of 4336	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	112
PID 4752 wrote to memory of 2320	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	113
PID 4752 wrote to memory of 2320	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	113
PID 4752 wrote to memory of 2320	4752	{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe	113
PID 4336 wrote to memory of 4944	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	114
PID 4336 wrote to memory of 4944	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	114
PID 4336 wrote to memory of 4944	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	114
PID 4336 wrote to memory of 2748	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	115
PID 4336 wrote to memory of 2748	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	115
PID 4336 wrote to memory of 2748	4336	{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe	115

C:\Users\Admin\AppData\Local\Temp\2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_e2943c3c0ba3f317bf5cad2bfea901e1_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
  C:\Windows\{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A3794~1.EXE > nul
    3⤵
    PID:3376
- - C:\Windows\{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
    C:\Windows\{D90A769B-7212-4896-86FE-EB14A828CD02}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D90A7~1.EXE > nul
      4⤵
      PID:2816
  - - C:\Windows\{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
      C:\Windows\{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Windows\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
        
        C:\Windows\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:652
      - C:\Windows\{256D2D70-3396-4e6e-9289-999722760E6B}.exe
        
        C:\Windows\{256D2D70-3396-4e6e-9289-999722760E6B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
        
        C:\Windows\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
        
        C:\Windows\{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
        
        C:\Windows\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
        
        C:\Windows\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe
        
        C:\Windows\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4944
        
        C:\Windows\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}.exe
        
        C:\Windows\{0F0AC57A-7E0C-4d1c-AB36-5C6D9507820E}.exe
        12⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71B06~1.EXE > nul
        11⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B679~1.EXE > nul
        10⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2E0E~1.EXE > nul
        9⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D8FE~1.EXE > nul
        8⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{256D2~1.EXE > nul
        7⤵
        
        PID:636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5BEBC~1.EXE > nul
        6⤵
        
        PID:512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48282~1.EXE > nul
        5⤵
        
        PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{256D2D70-3396-4e6e-9289-999722760E6B}.exe

Filesize
408KB

MD5
b8ae64a44348d3f830d885cd35279172

SHA1
847defdb8996ed4ad5ea6add632663ae2b039390

SHA256
3390a2c5d59859157954386ebdce14d27f61a5f6edc0bb156695e0edf527480f

SHA512
87f677a01ae93982e56acc1e91938f9b3a7d2311763aa2c2613c0ca368a85389f767e137015202b7bdd6bddedad4180d2a662e68d516da9e5d5d2f9f819f89a1

Download Submit
C:\Windows\{3B6798CF-C676-4167-B9FE-2AAC0D4727D9}.exe

Filesize
408KB

MD5
3ff5ae2f8358d1e3d5813bd0febae5e9

SHA1
032aa9d629a63ddb89bd013d232cb36e9aaf7686

SHA256
3ea50796786a31784653a9aa2a7bbb887ddb5e4022cc3aec748d8b03c056b7b2

SHA512
4a5211ede07140faf4f77e069b5e622fe3d693a2a696d7d1a035d372bd1b764ec2df0156115bf3300055781fbbe2e3c981c97963e265027e0863f53f2c2b647a

Download Submit
C:\Windows\{48282C43-D0F1-4083-8F94-BC024D5C256F}.exe

Filesize
408KB

MD5
5d8e93bf5dfbdc01d6dedb3831f6eb1a

SHA1
dccf5643f57ddbd9b73ba80d90d6940448ebe4d0

SHA256
77cfea2c57179b8e7016a5f33ce7348bda2cc243385d85f14bf4e1cced8b3a14

SHA512
a3b6385c4e015a4e9baa3d8ccd4bdd310ec3343f06f6b1fad93e35846246f44ef5b521c59c921505ed420cd98746d4812c3f1b2acaafdb643417e64cdbbd9dcc

Download Submit
C:\Windows\{5BEBC732-6A36-476b-B7CA-6D3EF1E820C7}.exe

Filesize
408KB

MD5
0cd3783770bcfeb2c7e835d93ec93317

SHA1
7893a074f0f4b0d5dc2d60df4fa4f21e24666dde

SHA256
077c1e972ab29f1997ecf9d99e580a9ae56aae0fff7070527c6510c70baa27fd

SHA512
905962320605dc5cc0d98eb9d459b3ee877fb8f980401949183d3f24b0207d9555da9523dad4ab1b0720584e9f39151567f8085c50b9291f6bc2f6dad60f6ce0

Download Submit
C:\Windows\{6D8FE74A-8BF3-4fb7-8221-EBA7AB6D78B4}.exe

Filesize
408KB

MD5
76d8722eccaaaa2f26b4fb20ff0c5332

SHA1
e3ad4ee9482cf45df32a3e99a38d2b7f2d48df07

SHA256
fb1fc3cd12f3f50dde8911535448d1f88e215edb7c1686d70e62ab3f91888896

SHA512
edc9094924428a1de6200cb2d87fe19732f5f33a9d051cadb6639e39fb76db0abdf36acd6478d59b1194b625dbf5761986db2689738061bc70defb186a680086

Download Submit
C:\Windows\{71B064D2-61AE-4790-88F6-D1A82E90F9B1}.exe

Filesize
408KB

MD5
ecb08513ca91f5be71c13a35e88b91c5

SHA1
655067cbbb1f7849a4f55c295ad7200bf937ee5d

SHA256
592b0caa4a1eb32c273c740ab6312ca9837953e09a7d03fee9736284cc9680cc

SHA512
ac72fc41b7dbdba87335053501de061850709d6d037a51fd8913750f0d7c823a5a37b943a177937123355038fe22903439672c60e270e96a9655a58c6aa8d236

Download Submit
C:\Windows\{A37947E6-8DF7-428f-8728-EC4A678D8578}.exe

Filesize
408KB

MD5
39e2596aa298ba937af933ccc7105eba

SHA1
9cce30ad063ebf4ef52aff507cca4845711fff2d

SHA256
de69000afabe2b4e89352b0adcd663a600e34ef4f10c0498399836b7449aa7c0

SHA512
7e9863c42ff9935b851863cc9f83f7329ff225a64b979ba463a2c763b08b6fd1a07e76130ab1f4427ee85a95dc57396caacf2141890fdb769936342672c30bd8

Download Submit
C:\Windows\{C6B61C0A-3F83-456b-ACC3-2E54F1753F26}.exe

Filesize
408KB

MD5
a903bab8491fd19fa4e2403dc0bc0a69

SHA1
df369d7b4ff00ba95c10bf7a41753a9b6f598411

SHA256
e3019e4ba917553d0f683c41bd31544beb140180372e072e7cc160409aeab187

SHA512
0950b2688ecaf2ab6d1df501fc6d82de6647eb0e09f915a46c2ed6db60eb5318d7764ac48ced6fa70d5eea8993cc0a24123673115191918d2c1d63ce4e83bfa0

Download Submit
C:\Windows\{D2E0E18E-4D65-471a-A628-62E11559FF14}.exe

Filesize
408KB

MD5
33dc9971239efb5226a9df3f3c1d1a04

SHA1
4d6be40d5309b1cbd85743b6323ca597fe2a8799

SHA256
a41a254c5b3347966cfa74ce6f945d63c1e0536e564d1fb33496f25f364b52f0

SHA512
afcbe636ca91df0208efd82ceca8a2840bd9190203219ed9670fb5fa2cc4d1adffefd40d0f5f1ef46b029125e771b2eff0019517428309e1f5a38230c8ec5bc7

Download Submit
C:\Windows\{D90A769B-7212-4896-86FE-EB14A828CD02}.exe

Filesize
408KB

MD5
d0ebbff4bbd967e91138cdbb4d8db229

SHA1
3f9a53da7e4572755153b3b38986df2216209249

SHA256
786b8e4d334de4eaf322cca6ae6fe75c6bc0e9145f3cc4c3c095cb6d724cd7b5

SHA512
f7cd31a4b8b601e759c637420f618fe1c9a997965e02a12b12dfa0e344b132a2c0a4c34183bb0fc7ca4d58b0e92bfb34fdc26c0027687416cd0a0b0256f2401f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads