0b1a9425274d717d5cd5029747cb31d414be5e1e73b25c397e6e63fa3c5899cd

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
Size

197KB
MD5

54b75c41945967a4351185745e053f43
SHA1

d0ee100ca1b87e7176c927891fa9f4a5835dd6eb
SHA256

0b1a9425274d717d5cd5029747cb31d414be5e1e73b25c397e6e63fa3c5899cd
SHA512

16be7bdd37b31fc7bb8d45e00922a7ae6d178b115f734c7b90be88ec886d138b5bddfa058440347f6df1071442117e1943cd7a465d28beb0548418e1f4c080f4
SSDEEP

3072:jEGh0oll+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGblEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000139e6-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000013a24-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000139e6-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000142cc-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a5a-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000139e6-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a5a-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000139e6-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a5a-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000139e6-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a5a-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}\stubpath = "C:\\Windows\\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe"	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}\stubpath = "C:\\Windows\\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe"	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}\stubpath = "C:\\Windows\\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe"	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}	{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}\stubpath = "C:\\Windows\\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe"	{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}\stubpath = "C:\\Windows\\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe"	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}\stubpath = "C:\\Windows\\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe"	{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}\stubpath = "C:\\Windows\\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe"	{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7546F38E-5666-47e3-84FA-6A894319B6FF}	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}\stubpath = "C:\\Windows\\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe"	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}	{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7546F38E-5666-47e3-84FA-6A894319B6FF}\stubpath = "C:\\Windows\\{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe"	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}\stubpath = "C:\\Windows\\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe"	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}\stubpath = "C:\\Windows\\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe"	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}	{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe

Deletes itself 1 IoCs

pid	Process
3008	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
1316	{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
2248	{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
2256	{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
1180	{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
File created	C:\Windows\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
File created	C:\Windows\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
File created	C:\Windows\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
File created	C:\Windows\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
File created	C:\Windows\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe	{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
File created	C:\Windows\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
File created	C:\Windows\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
File created	C:\Windows\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe	{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
File created	C:\Windows\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe	{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
File created	C:\Windows\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
Token: SeIncBasePriorityPrivilege	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
Token: SeIncBasePriorityPrivilege	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
Token: SeIncBasePriorityPrivilege	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
Token: SeIncBasePriorityPrivilege	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
Token: SeIncBasePriorityPrivilege	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
Token: SeIncBasePriorityPrivilege	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
Token: SeIncBasePriorityPrivilege	1316	{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
Token: SeIncBasePriorityPrivilege	2248	{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
Token: SeIncBasePriorityPrivilege	2256	{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2912	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	28
PID 2900 wrote to memory of 2912	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	28
PID 2900 wrote to memory of 2912	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	28
PID 2900 wrote to memory of 2912	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	28
PID 2900 wrote to memory of 3008	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	29
PID 2900 wrote to memory of 3008	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	29
PID 2900 wrote to memory of 3008	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	29
PID 2900 wrote to memory of 3008	2900	2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe	29
PID 2912 wrote to memory of 2688	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	30
PID 2912 wrote to memory of 2688	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	30
PID 2912 wrote to memory of 2688	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	30
PID 2912 wrote to memory of 2688	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	30
PID 2912 wrote to memory of 2620	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	31
PID 2912 wrote to memory of 2620	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	31
PID 2912 wrote to memory of 2620	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	31
PID 2912 wrote to memory of 2620	2912	{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe	31
PID 2688 wrote to memory of 2780	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	33
PID 2688 wrote to memory of 2780	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	33
PID 2688 wrote to memory of 2780	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	33
PID 2688 wrote to memory of 2780	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	33
PID 2688 wrote to memory of 2496	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	32
PID 2688 wrote to memory of 2496	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	32
PID 2688 wrote to memory of 2496	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	32
PID 2688 wrote to memory of 2496	2688	{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe	32
PID 2780 wrote to memory of 2784	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	37
PID 2780 wrote to memory of 2784	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	37
PID 2780 wrote to memory of 2784	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	37
PID 2780 wrote to memory of 2784	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	37
PID 2780 wrote to memory of 2156	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	36
PID 2780 wrote to memory of 2156	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	36
PID 2780 wrote to memory of 2156	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	36
PID 2780 wrote to memory of 2156	2780	{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe	36
PID 2784 wrote to memory of 2676	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	39
PID 2784 wrote to memory of 2676	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	39
PID 2784 wrote to memory of 2676	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	39
PID 2784 wrote to memory of 2676	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	39
PID 2784 wrote to memory of 2956	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	38
PID 2784 wrote to memory of 2956	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	38
PID 2784 wrote to memory of 2956	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	38
PID 2784 wrote to memory of 2956	2784	{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe	38
PID 2676 wrote to memory of 1640	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	41
PID 2676 wrote to memory of 1640	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	41
PID 2676 wrote to memory of 1640	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	41
PID 2676 wrote to memory of 1640	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	41
PID 2676 wrote to memory of 2776	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	40
PID 2676 wrote to memory of 2776	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	40
PID 2676 wrote to memory of 2776	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	40
PID 2676 wrote to memory of 2776	2676	{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe	40
PID 1640 wrote to memory of 2792	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	43
PID 1640 wrote to memory of 2792	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	43
PID 1640 wrote to memory of 2792	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	43
PID 1640 wrote to memory of 2792	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	43
PID 1640 wrote to memory of 2936	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	42
PID 1640 wrote to memory of 2936	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	42
PID 1640 wrote to memory of 2936	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	42
PID 1640 wrote to memory of 2936	1640	{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe	42
PID 2792 wrote to memory of 1316	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	44
PID 2792 wrote to memory of 1316	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	44
PID 2792 wrote to memory of 1316	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	44
PID 2792 wrote to memory of 1316	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	44
PID 2792 wrote to memory of 1436	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	45
PID 2792 wrote to memory of 1436	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	45
PID 2792 wrote to memory of 1436	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	45
PID 2792 wrote to memory of 1436	2792	{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_54b75c41945967a4351185745e053f43_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
  C:\Windows\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
    C:\Windows\{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7546F~1.EXE > nul
      4⤵
      PID:2496
  - - C:\Windows\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
      C:\Windows\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD887~1.EXE > nul
        5⤵
        
        PID:2156
    - - C:\Windows\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
        
        C:\Windows\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2784
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{807A5~1.EXE > nul
        6⤵
        
        PID:2956
      - C:\Windows\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
        
        C:\Windows\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A531~1.EXE > nul
        7⤵
        
        PID:2776
        
        C:\Windows\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
        
        C:\Windows\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EFB9~1.EXE > nul
        8⤵
        
        PID:2936
        
        C:\Windows\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
        
        C:\Windows\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
        
        C:\Windows\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
        
        C:\Windows\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
        
        C:\Windows\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Windows\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe
        
        C:\Windows\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe
        12⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C26C2~1.EXE > nul
        12⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BFBAE~1.EXE > nul
        11⤵
        
        PID:600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4FBC7~1.EXE > nul
        10⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{27277~1.EXE > nul
        9⤵
        
        PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6BBDD~1.EXE > nul
    3⤵
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{27277BA2-3C87-4c81-AC2D-55F734D7CBD1}.exe

Filesize
197KB

MD5
be5d0bcd51c56ab4fce2c641c18c4676

SHA1
c814c12c4fa6812203a990b4b1e78b23b92c154a

SHA256
88505072e331fb7fa6664a3ce1becd9d94bfd67bc6ed39076bd32ecbfab6abbd

SHA512
3058024547e629190e0616b06183698d4fc6b20b32e53cd1558267784156f5e3f16507b36f9976c49b8768ebfc2445447cd1bff99d111c0898883f48e1945f6b

Download Submit
C:\Windows\{4FBC7550-B75D-4428-9DBA-7E90EF060D11}.exe

Filesize
197KB

MD5
40b38227c809a42ffacc983fe2175f45

SHA1
fd36d7576189dc8b5207ffef2e105294d7775466

SHA256
8b1b1b99ff115d780feaf25b97ca67820f25cea85224e2637b43dcdfdb81b79c

SHA512
495418ebb05c0b3d696d57441a1040d6ddc6887472c7d11b4fcadb47a23247584203b85c0680fedf7c5d0d13e1abc5e28c5196530d4c72399b4d48d996aab064

Download Submit
C:\Windows\{6BBDDEEC-145B-4f62-95D7-F45AE3815376}.exe

Filesize
197KB

MD5
3993689ddf38ad63e2ffc3862f3021f5

SHA1
0ca96967fcbf66b6b6823498da59f2e81d2e4f4d

SHA256
cf24a61ff0b2968fe83110c17dcddc92ab2490279e110d48606a64c04deec18b

SHA512
5d0dcb55febdc211d640cf504080bc6f62926cdb915a0d133d94d0af05480f01a1ce96225fde389085acd1aa99a9d0bf10844140c2fcafd32acdfc71bc8670c0

Download Submit
C:\Windows\{6EFB9DD6-4AEC-4764-AE22-57773952F72E}.exe

Filesize
197KB

MD5
d835bb843e6283e7cd1cddcc9010f974

SHA1
a5dd7836560707252c1b053ce44d51916da72e6e

SHA256
5d5e4894e20fc8b6712e9e1d14780925fa1bc53676afc2e6603b4f62376acbd6

SHA512
74424f917b18953885732b671c783c555fc042d0537560e3e5868fd311804d672cf9b4e2356d497cd60519c2c0ff9d1a6d5c61cec91e880436225af600450f4d

Download Submit
C:\Windows\{7546F38E-5666-47e3-84FA-6A894319B6FF}.exe

Filesize
197KB

MD5
70e8866d7636404832e5910685df05e6

SHA1
34e950cea90adc0cbcb5737bdd422fa952c6cd33

SHA256
4440371f0e51ff354712cf29c9fb5a92191e6bc0bbcb3dc0662e94516317a0bb

SHA512
318f0dd57a8881694604bea5e09a42ae831d304c71c19e5ea2e474d4fc800ecf762f916f2798113b0e842451caaa0d5d78ad1a5c232adec278ef44b34040dff0

Download Submit
C:\Windows\{7A531BFB-FDD1-4159-A6F8-74F3E7AA5165}.exe

Filesize
197KB

MD5
28d744931b77398251f892aeb7f655a5

SHA1
1263326dfc89c798392ecfc6ccaeec5d1af78fdb

SHA256
d344f973cf38c699de19ad380adec3301509b233d22ca1649935977ffbd290ff

SHA512
3253232c76b008c16c4ec8c525a12c62191791fdae828e4bb7513eed3aa0899cdfdbd4e1eca84775777cbf2fb46989843449ed38fbaad4889c96a10037f5bd26

Download Submit
C:\Windows\{807A5FA2-902B-438e-85E6-D7CD4AF044AD}.exe

Filesize
197KB

MD5
b2b5f84ef68c5ce380b1ff32420e3a00

SHA1
5a6e36f22881818c91ecdc8923b7dc9856dd990a

SHA256
8d4bf164f418933d528a83de57828f38cb7d671439409fe070e2a98d123bf53e

SHA512
32c79a67baacfb04223625999c71a3deef1ec1c32a5ab97f36142a3a220dfde3d6c61e23f5ff4ec74d7a6cd9ebc2ae9b040577d5dd07280db51e07c8af4f082e

Download Submit
C:\Windows\{A49DD9A1-0784-41ec-8E5D-E12ED57ABE6F}.exe

Filesize
197KB

MD5
a7b42ce37a581ed985f10de420a89999

SHA1
2d6c41d1d1f1682601d5e60b50437b07b653b5d6

SHA256
e776d8c1691e70d51afff067e5275797fe8ef7841888cbda421295323c57a1bc

SHA512
23ed7d64d08c4cfcb5fd32572fd819c398d9a1886d12bc92675e891ff6388c65a4fd56216c2c67e4bd7169794583ff102720bb3fb8f92ce2f153647d84b5ce35

Download Submit
C:\Windows\{BFBAEB1A-3115-4185-9333-DCEE7D79B34E}.exe

Filesize
197KB

MD5
0547f34bd24cd280ed71032700b69b0d

SHA1
8305bb5e1d76bdf4cc385d5341a25a3ac12bf4af

SHA256
f55e81046bdfc997d582829119d23b46e894989c7c9fcc3a534cedcd64dac69b

SHA512
3263ee80f3fee1833844b874540871b5c6259cdaa4662b045097621b8179ead49c71720e8dc2384bcb9cc5efaa8260c600ca4b38ed9c8680447a2f14fe912efc

Download Submit
C:\Windows\{C26C254B-ADFA-47bc-BE91-7B21685A9F00}.exe

Filesize
197KB

MD5
9594d2b271530fedd53e8582c6252952

SHA1
ca1326c33d5fba3ebd4d2a4e271c01c97b9dedf1

SHA256
f84f0a75698c90c6a8a3350722611b59e89cf85c73c0292dc70c7682dad0ddf5

SHA512
8971eadb07931b04248e80deddcd15ba918e0a627c282ac7045ea7de6415116904354b72645dc36cb6cdf33d7f1c6302451e3631bd44adecf9066f253202a60f

Download Submit
C:\Windows\{FD8879B1-5A99-4615-8A64-3BA1F51595EF}.exe

Filesize
197KB

MD5
e4e38e74d803f62f11ccbc4a388ac829

SHA1
f9e3bfcc2cc8375cfc9f6f332d6ef018123d3ea1

SHA256
150e14c111d9905f0a80239bf9c971179c4c16e42a79dd6b0e3aea6714a3c3a1

SHA512
81ecf4be7095fd4d0203015152fd94c584451930613aa7f307de89033de5243ce89f197e579a477282f61c41499e835103a0ef1369e519273a61d0537a72e9af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads