e135817364bb619c797be1cf321e92579387f36170b7d696d246ddae6e143ed8

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Size

168KB
MD5

f495162d79908d0f44e3802b4f30d6ff
SHA1

24761d93baa01fb00e0937c0c2d848388125c4c9
SHA256

e135817364bb619c797be1cf321e92579387f36170b7d696d246ddae6e143ed8
SHA512

4cfa6b52b8dc629ae6138f0a0cd2aeedd21fa436b7c1083dd5de83c03e013a488bae371a231af24cd2307aedd7af14ed17354d4f92714953400eea8ee9206a34
SSDEEP

1536:1EGh0oSlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oSlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012270-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0034000000016047-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002900000000b1f4-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002a00000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000016047-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000016047-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0037000000016047-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}\stubpath = "C:\\Windows\\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe"	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2378CA21-B50C-4f68-B418-845669BC6922}	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}\stubpath = "C:\\Windows\\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe"	{2378CA21-B50C-4f68-B418-845669BC6922}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0C4F07E-4E53-496b-A435-B7034052EC99}\stubpath = "C:\\Windows\\{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe"	{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}	{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}\stubpath = "C:\\Windows\\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe"	{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}\stubpath = "C:\\Windows\\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe"	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7ED31FE-74D6-4a39-9196-540030230EC9}	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7ED31FE-74D6-4a39-9196-540030230EC9}\stubpath = "C:\\Windows\\{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe"	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0C4F07E-4E53-496b-A435-B7034052EC99}	{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E3C10181-F621-4721-9D9B-27462BA38FF2}	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}\stubpath = "C:\\Windows\\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe"	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}\stubpath = "C:\\Windows\\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe"	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2378CA21-B50C-4f68-B418-845669BC6922}\stubpath = "C:\\Windows\\{2378CA21-B50C-4f68-B418-845669BC6922}.exe"	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E3C10181-F621-4721-9D9B-27462BA38FF2}\stubpath = "C:\\Windows\\{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe"	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}\stubpath = "C:\\Windows\\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe"	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}	{2378CA21-B50C-4f68-B418-845669BC6922}.exe

Deletes itself 1 IoCs

pid	Process
2748	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
2824	{2378CA21-B50C-4f68-B418-845669BC6922}.exe
2128	{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
3020	{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
816	{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe	{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
File created	C:\Windows\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
File created	C:\Windows\{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
File created	C:\Windows\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
File created	C:\Windows\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
File created	C:\Windows\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe	{2378CA21-B50C-4f68-B418-845669BC6922}.exe
File created	C:\Windows\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe	{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
File created	C:\Windows\{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
File created	C:\Windows\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
File created	C:\Windows\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
File created	C:\Windows\{2378CA21-B50C-4f68-B418-845669BC6922}.exe	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
Token: SeIncBasePriorityPrivilege	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
Token: SeIncBasePriorityPrivilege	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
Token: SeIncBasePriorityPrivilege	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
Token: SeIncBasePriorityPrivilege	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
Token: SeIncBasePriorityPrivilege	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
Token: SeIncBasePriorityPrivilege	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
Token: SeIncBasePriorityPrivilege	2824	{2378CA21-B50C-4f68-B418-845669BC6922}.exe
Token: SeIncBasePriorityPrivilege	2128	{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
Token: SeIncBasePriorityPrivilege	3020	{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2272	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	28
PID 2428 wrote to memory of 2272	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	28
PID 2428 wrote to memory of 2272	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	28
PID 2428 wrote to memory of 2272	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	28
PID 2428 wrote to memory of 2748	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	29
PID 2428 wrote to memory of 2748	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	29
PID 2428 wrote to memory of 2748	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	29
PID 2428 wrote to memory of 2748	2428	2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe	29
PID 2272 wrote to memory of 2876	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	30
PID 2272 wrote to memory of 2876	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	30
PID 2272 wrote to memory of 2876	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	30
PID 2272 wrote to memory of 2876	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	30
PID 2272 wrote to memory of 2908	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	31
PID 2272 wrote to memory of 2908	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	31
PID 2272 wrote to memory of 2908	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	31
PID 2272 wrote to memory of 2908	2272	{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe	31
PID 2876 wrote to memory of 1104	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	34
PID 2876 wrote to memory of 1104	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	34
PID 2876 wrote to memory of 1104	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	34
PID 2876 wrote to memory of 1104	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	34
PID 2876 wrote to memory of 2492	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	35
PID 2876 wrote to memory of 2492	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	35
PID 2876 wrote to memory of 2492	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	35
PID 2876 wrote to memory of 2492	2876	{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe	35
PID 1104 wrote to memory of 676	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	36
PID 1104 wrote to memory of 676	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	36
PID 1104 wrote to memory of 676	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	36
PID 1104 wrote to memory of 676	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	36
PID 1104 wrote to memory of 2820	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	37
PID 1104 wrote to memory of 2820	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	37
PID 1104 wrote to memory of 2820	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	37
PID 1104 wrote to memory of 2820	1104	{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe	37
PID 676 wrote to memory of 992	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	38
PID 676 wrote to memory of 992	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	38
PID 676 wrote to memory of 992	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	38
PID 676 wrote to memory of 992	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	38
PID 676 wrote to memory of 2984	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	39
PID 676 wrote to memory of 2984	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	39
PID 676 wrote to memory of 2984	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	39
PID 676 wrote to memory of 2984	676	{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe	39
PID 992 wrote to memory of 2488	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	40
PID 992 wrote to memory of 2488	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	40
PID 992 wrote to memory of 2488	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	40
PID 992 wrote to memory of 2488	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	40
PID 992 wrote to memory of 2028	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	41
PID 992 wrote to memory of 2028	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	41
PID 992 wrote to memory of 2028	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	41
PID 992 wrote to memory of 2028	992	{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe	41
PID 2488 wrote to memory of 1356	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	42
PID 2488 wrote to memory of 1356	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	42
PID 2488 wrote to memory of 1356	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	42
PID 2488 wrote to memory of 1356	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	42
PID 2488 wrote to memory of 1988	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	43
PID 2488 wrote to memory of 1988	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	43
PID 2488 wrote to memory of 1988	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	43
PID 2488 wrote to memory of 1988	2488	{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe	43
PID 1356 wrote to memory of 2824	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	44
PID 1356 wrote to memory of 2824	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	44
PID 1356 wrote to memory of 2824	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	44
PID 1356 wrote to memory of 2824	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	44
PID 1356 wrote to memory of 2868	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	45
PID 1356 wrote to memory of 2868	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	45
PID 1356 wrote to memory of 2868	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	45
PID 1356 wrote to memory of 2868	1356	{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f495162d79908d0f44e3802b4f30d6ff_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
  C:\Windows\{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
    C:\Windows\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
      C:\Windows\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
        
        C:\Windows\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
      - C:\Windows\{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
        
        C:\Windows\{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
        
        C:\Windows\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
        
        C:\Windows\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\{2378CA21-B50C-4f68-B418-845669BC6922}.exe
        
        C:\Windows\{2378CA21-B50C-4f68-B418-845669BC6922}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
        
        C:\Windows\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
        
        C:\Windows\{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Windows\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe
        
        C:\Windows\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe
        12⤵
        Executes dropped EXE
        
        PID:816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0C4F~1.EXE > nul
        12⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0F4AA~1.EXE > nul
        11⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2378C~1.EXE > nul
        10⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5BC1~1.EXE > nul
        9⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D30BF~1.EXE > nul
        8⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7ED3~1.EXE > nul
        7⤵
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C2CDC~1.EXE > nul
        6⤵
        
        PID:2984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EFD8B~1.EXE > nul
        5⤵
        
        PID:2820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FCA0D~1.EXE > nul
      4⤵
      PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E3C10~1.EXE > nul
    3⤵
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0F4AA0EB-67E5-4558-8A0C-7BF91127578D}.exe

Filesize
168KB

MD5
c88710f9f63d4f963e653ac08111967c

SHA1
f9f31f05ea60564a73337a8f7d00a0770da35746

SHA256
6c2c440403e4a9a470c7f310b007bc17b1aad01318d0c887d66cba857f220e0d

SHA512
6e45996e428b936f6ed5607c483bee2546f433020cae76b2bcaba129139e891d82d26feb4866fc33d613f746fc2cdae0236f9ad59cd43eb2810e7773061ea945

Download Submit
C:\Windows\{2378CA21-B50C-4f68-B418-845669BC6922}.exe

Filesize
168KB

MD5
eed0da4d7dc0fa5e3a5679233c1e5726

SHA1
7ad040aa28644ba79044687e346976ac896a4aa5

SHA256
0b67b0ad9a129c4ee7d62d9eb4fecf0738a09beb1ff15f9e4b13c11c782abc20

SHA512
39f94d5ea2696022d2a252e91c8b37da668ded8e4b597d47150f50bee30e58888dfe1ad802c64a7a283c66434b056e70a3be5d9ab78303896010dae01fc28df9

Download Submit
C:\Windows\{B0C4F07E-4E53-496b-A435-B7034052EC99}.exe

Filesize
168KB

MD5
94b9ff34d6ff2f4323104b1723a796fc

SHA1
daf2849b355b0c3c017bca3b77b03e13f21675e4

SHA256
7879be7242ea41dfaa8a0e9dbc5954c001aa2e4042949f4794ed8347ac79fe3c

SHA512
8a70e603d54d8c82eb983c89a47e355832603a272f8d26d7f03aee0ad192d289d0a39d201a4ce037928a10cab5deb2e79229eb894966b77c75b786a5f409fcaf

Download Submit
C:\Windows\{C2CDCFA6-4441-4aca-A355-64CE0C5AFBC6}.exe

Filesize
168KB

MD5
b572ec29b7e9ba7a0de9e0b9c6bf6d83

SHA1
c1c694501d52a7ac84af020cad78b483a2d57368

SHA256
b533e44d52072a2973cbc755daf04bca52593526c12a5704d90df2a79e223d77

SHA512
175ea676f3777ca93d67a6355fe5cbe205a678c240ae00c28160e5715501509d96281be96d64c1c8f4002895538b6e5020d9a0f9c8fbaa83bc53ff6596167a13

Download Submit
C:\Windows\{D30BFFD8-3255-4ab2-A68A-D3AB8A090C66}.exe

Filesize
168KB

MD5
f3a7993daa76dadb2fd93d30e8d012eb

SHA1
055ea1e367bd6b92270e98117951214f6d6380f2

SHA256
a430e6c316eaedcc49c569ebb30daa85f562302b331d263b9755a5e7b832df6b

SHA512
1783b070390a4600c9c7f0158062e5c057b158e5e142bb164a012c223eec98d627494691cbe08b23a9e9627846b214a2856f00d03da3ee7dd3ee16e84a4230b8

Download Submit
C:\Windows\{D5BC1E27-696F-4b44-87DB-8014283B1EBB}.exe

Filesize
168KB

MD5
2e1d9f5ce2671c19e968bba4145855cc

SHA1
a8b74cfcf6e5e0618e48d378a35b7ea72d854712

SHA256
0b33fd23f5f909560880b41b15662a466274b2607e349e447ab3d018ea2665ed

SHA512
49c9d12e94ddf0e977d979af447a410721d8ca596b255b3b2af870675f2ef6868125cbe90322d108110837766f8344d0a75e52f2ac6a2f7654ea95336f07c40c

Download Submit
C:\Windows\{D7ED31FE-74D6-4a39-9196-540030230EC9}.exe

Filesize
168KB

MD5
a76fd84d8feb0169c5ba5fcfeaabef59

SHA1
02853fc93360ab0914a6a8d63ab6977e461fc85c

SHA256
9a6a0d86faba7d5a5207a16e186791c0b460c04ee3524fe110a2cfe650999cb0

SHA512
856a27bbdea04c7cce1b46b8529548cf27018d79a604b8bb98819ddac81495482d658be862fb0b08fd8df463d7b2bd3f63908feaea81bc2d4e5f591fac0ea661

Download Submit
C:\Windows\{E0BC3216-F98E-4ce8-B3B6-7005C9030853}.exe

Filesize
168KB

MD5
ac36022e6e7eb10c4d12755504284280

SHA1
9981bbd6c6bc99e61288f78d747b06a8ee08b67c

SHA256
64901f761065bd93d276c2bf7a4f4b2f10e95fed3de4141c3b4f3104213f683d

SHA512
1ddda69bbc3debe3130b35450b9781e298dc9c790ead803739207a16fb13174328842da0baaa4b9a27e1a10b76abcf48afadfcc1527ef786f7ad2a73f041b199

Download Submit
C:\Windows\{E3C10181-F621-4721-9D9B-27462BA38FF2}.exe

Filesize
168KB

MD5
098d3d5d6d11dfb2f930e9abd36c6d88

SHA1
59ddeebfafbeaf020dedd4d8a0c9cb0b34b395c6

SHA256
511f0c169dd79e806527ae7ad70f1d62b66fa8fe2056090efb9e20e0acd64b80

SHA512
327a65ebf06aba21343d6f4de0ab961a1045b45395e924ca905afa4ec0e8853554ee35af1c726e7f34fc7fad50b16f2f338a966f5a6cfb2a56e9cb0a905454b0

Download Submit
C:\Windows\{EFD8BDE4-CC01-4e9f-8783-ADCEC832590D}.exe

Filesize
168KB

MD5
22f7696295b66408a29fa76539d8fc27

SHA1
24afa2d510d26dbea5bb95906b160d508b6bce53

SHA256
575b845bee607173b46c8e97c942838d70b3272ffaec4db346dee6ed360307b8

SHA512
b2d35d7b474f7a391a7304bfbf1f19f57f816f9b47e9d38cb71e12a690b567066ca1684dc637d3c7f365571869b64817dae8b9d8696680841d9cbc72e9bdd7d9

Download Submit
C:\Windows\{FCA0D1CE-9250-47e8-8DD9-C007BD0BBAFD}.exe

Filesize
168KB

MD5
4d11eff9ef3deccec6228c30a554d5ad

SHA1
3a9171525a098b486c7245e9064081ec62c8d99d

SHA256
f7af8d5dea69129b76bb5cfb651da1613092e0d4518deab4f91e8e39188e4276

SHA512
b13fcfeb2969cc3438d1a605568d9f2e1cb6eea4418b78f0ee2857bae558063832d64a1ce526f842e5affe240ee65e517e17b4deeeb4b4e6aede5863e3b11d8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads