1c79a8b69b7bbd2045fe0be9b51fcbe008c28a8e60be0188489e04ad12261b3b

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Size

197KB
MD5

386057845b1cf6cb6bb2135e02f1b81b
SHA1

600d0cbd701643815c26eaa246ddce2aa37cab44
SHA256

1c79a8b69b7bbd2045fe0be9b51fcbe008c28a8e60be0188489e04ad12261b3b
SHA512

3941e616d9f4958726f29e69fbb64158b753fcc5d8a8d900449b0251ccccfd1c3cdac4c3c6eec9e7c190e4adb613463d0f0279281662665f285a4f1e684e706f
SSDEEP

3072:jEGh0oJl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGDlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023026-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002313a-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023142-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002313a-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023142-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-25.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}\stubpath = "C:\\Windows\\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe"	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}\stubpath = "C:\\Windows\\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe"	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}\stubpath = "C:\\Windows\\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe"	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}\stubpath = "C:\\Windows\\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe"	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}\stubpath = "C:\\Windows\\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe"	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26A88DE2-0996-477f-AA0A-1D550A99CC86}	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}\stubpath = "C:\\Windows\\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe"	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}\stubpath = "C:\\Windows\\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe"	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4663981F-96F3-4cab-8966-350EAEE6DB27}	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}\stubpath = "C:\\Windows\\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe"	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26A88DE2-0996-477f-AA0A-1D550A99CC86}\stubpath = "C:\\Windows\\{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe"	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4663981F-96F3-4cab-8966-350EAEE6DB27}\stubpath = "C:\\Windows\\{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe"	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}\stubpath = "C:\\Windows\\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe"	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe

Executes dropped EXE 11 IoCs

pid	Process
2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
396	{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
File created	C:\Windows\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
File created	C:\Windows\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
File created	C:\Windows\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
File created	C:\Windows\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
File created	C:\Windows\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
File created	C:\Windows\{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
File created	C:\Windows\{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
File created	C:\Windows\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
File created	C:\Windows\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
File created	C:\Windows\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
Token: SeIncBasePriorityPrivilege	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
Token: SeIncBasePriorityPrivilege	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
Token: SeIncBasePriorityPrivilege	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
Token: SeIncBasePriorityPrivilege	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
Token: SeIncBasePriorityPrivilege	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
Token: SeIncBasePriorityPrivilege	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
Token: SeIncBasePriorityPrivilege	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
Token: SeIncBasePriorityPrivilege	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
Token: SeIncBasePriorityPrivilege	3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2612	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	89
PID 4004 wrote to memory of 2612	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	89
PID 4004 wrote to memory of 2612	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	89
PID 4004 wrote to memory of 4168	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	90
PID 4004 wrote to memory of 4168	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	90
PID 4004 wrote to memory of 4168	4004	2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe	90
PID 2612 wrote to memory of 456	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	97
PID 2612 wrote to memory of 456	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	97
PID 2612 wrote to memory of 456	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	97
PID 2612 wrote to memory of 4828	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	98
PID 2612 wrote to memory of 4828	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	98
PID 2612 wrote to memory of 4828	2612	{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe	98
PID 456 wrote to memory of 1352	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	100
PID 456 wrote to memory of 1352	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	100
PID 456 wrote to memory of 1352	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	100
PID 456 wrote to memory of 1516	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	99
PID 456 wrote to memory of 1516	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	99
PID 456 wrote to memory of 1516	456	{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe	99
PID 1352 wrote to memory of 4716	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	101
PID 1352 wrote to memory of 4716	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	101
PID 1352 wrote to memory of 4716	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	101
PID 1352 wrote to memory of 5036	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	102
PID 1352 wrote to memory of 5036	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	102
PID 1352 wrote to memory of 5036	1352	{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe	102
PID 4716 wrote to memory of 4796	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	103
PID 4716 wrote to memory of 4796	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	103
PID 4716 wrote to memory of 4796	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	103
PID 4716 wrote to memory of 3576	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	104
PID 4716 wrote to memory of 3576	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	104
PID 4716 wrote to memory of 3576	4716	{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe	104
PID 4796 wrote to memory of 2676	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	105
PID 4796 wrote to memory of 2676	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	105
PID 4796 wrote to memory of 2676	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	105
PID 4796 wrote to memory of 3980	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	106
PID 4796 wrote to memory of 3980	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	106
PID 4796 wrote to memory of 3980	4796	{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe	106
PID 2676 wrote to memory of 5024	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	107
PID 2676 wrote to memory of 5024	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	107
PID 2676 wrote to memory of 5024	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	107
PID 2676 wrote to memory of 4400	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	108
PID 2676 wrote to memory of 4400	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	108
PID 2676 wrote to memory of 4400	2676	{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe	108
PID 5024 wrote to memory of 3740	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	109
PID 5024 wrote to memory of 3740	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	109
PID 5024 wrote to memory of 3740	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	109
PID 5024 wrote to memory of 3568	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	110
PID 5024 wrote to memory of 3568	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	110
PID 5024 wrote to memory of 3568	5024	{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe	110
PID 3740 wrote to memory of 4728	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	111
PID 3740 wrote to memory of 4728	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	111
PID 3740 wrote to memory of 4728	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	111
PID 3740 wrote to memory of 4220	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	112
PID 3740 wrote to memory of 4220	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	112
PID 3740 wrote to memory of 4220	3740	{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe	112
PID 4728 wrote to memory of 3120	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	113
PID 4728 wrote to memory of 3120	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	113
PID 4728 wrote to memory of 3120	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	113
PID 4728 wrote to memory of 4004	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	114
PID 4728 wrote to memory of 4004	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	114
PID 4728 wrote to memory of 4004	4728	{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe	114
PID 3120 wrote to memory of 396	3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe	115
PID 3120 wrote to memory of 396	3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe	115
PID 3120 wrote to memory of 396	3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe	115
PID 3120 wrote to memory of 2112	3120	{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe	116

C:\Users\Admin\AppData\Local\Temp\2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_386057845b1cf6cb6bb2135e02f1b81b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
  C:\Windows\{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
    C:\Windows\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AE6D3~1.EXE > nul
      4⤵
      PID:1516
  - - C:\Windows\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
      C:\Windows\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\Windows\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
        
        C:\Windows\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
      - C:\Windows\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
        
        C:\Windows\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
        
        C:\Windows\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
        
        C:\Windows\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
        
        C:\Windows\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
        
        C:\Windows\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
        
        C:\Windows\{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe
        
        C:\Windows\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe
        12⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{26A88~1.EXE > nul
        12⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{52AC4~1.EXE > nul
        11⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8599F~1.EXE > nul
        10⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0E589~1.EXE > nul
        9⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F61DC~1.EXE > nul
        8⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A5B4~1.EXE > nul
        7⤵
        
        PID:3980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F53A7~1.EXE > nul
        6⤵
        
        PID:3576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{543E0~1.EXE > nul
        5⤵
        
        PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{46639~1.EXE > nul
    3⤵
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A5B4EB5-6A12-4515-AC66-8572CCE37F3A}.exe

Filesize
197KB

MD5
e696a42652314b157d4f82d2f1dc11f0

SHA1
28c858e91e88700a4d675b2c0e1551e1fa0ee7b5

SHA256
fb69d717ec38ffc52efd9545946cd6f1c11701eafa6b7e9ee0eb42ca627e48b1

SHA512
c596d58c330b80a1a5f82a679588fa4ea74eaa250df5aa7ff85efa06221a736a821ae941ac40535481d8cc74d88543cf9e968d501278d17d3affe1bbf93b0992

Download Submit
C:\Windows\{0E3BC451-EC91-40c1-9DBD-A2F6E1596535}.exe

Filesize
197KB

MD5
7a24ee894e2f97ae1afb0ec613a28180

SHA1
eef91b89aa4d420fc5b29427573232a108e76416

SHA256
4f74e78b113eaedabdaf3346c905758b20f62bf616f0dffa3374917c4eb22807

SHA512
b290c39997f7387ed72cc468c170668ee90442276f2de19c94bcc78329f247556396cb65e6a2e1ef13856053de35bb53e77ce943c1853e95ac83fecfc1fa8fa9

Download Submit
C:\Windows\{0E589FEA-CE49-4878-9F17-C3F1E44ED192}.exe

Filesize
197KB

MD5
ed79564f27a02cbb20e761bad9b667e9

SHA1
da8e9dd7d1e1295aebbf2d07822f302aeab305b6

SHA256
f26144cddfa92bbf6fd6c7f927a4804ceb7a63f4b3c89046816423a2f8196ebc

SHA512
d435156db46cf12dc07d12f995aa0dcbee041c01ba6e6c5888bb0ce45e422564a3de4c05a6ac5b29515419318eb9e485df1740a13e710226a205f96476e5eac9

Download Submit
C:\Windows\{26A88DE2-0996-477f-AA0A-1D550A99CC86}.exe

Filesize
197KB

MD5
76e14fe30f08725148bf8feac7ac8096

SHA1
a41c5883a2b04add8dfd1dca4ff00afbf6364575

SHA256
86b91b5c2621bca2f3b7bb5b678d266ae685fe9b9854138e0b7094a6c8639a65

SHA512
b1cbc238196ba51b7027e1381c72e0183f909773bd653e52a055d61e72677df2eeabfaa3e3a6f69ce4843730f61660f3654d7bf1888b44f6aa7affe39d66819a

Download Submit
C:\Windows\{4663981F-96F3-4cab-8966-350EAEE6DB27}.exe

Filesize
197KB

MD5
dfe2f80aeecc3f213f25e07a9a6efc81

SHA1
cdae99e1e072bdbdd2db77b7d8025026a75e33c1

SHA256
e47d79425a0c88006d084c774e5ac13720844817c9962ccb6fe49b6769029753

SHA512
6e5021e5df13918c72a06de97c0edc92bba6f23cf76de23680522136387ea780e80421dd831c47fa2d68e622b6e5d3ad369ab467882d94d53ba897caffb66e48

Download Submit
C:\Windows\{52AC4D5F-5FE4-4c4b-8D32-731DB44F9476}.exe

Filesize
197KB

MD5
7aea64fca33cb22c22b52813a5563d72

SHA1
bee3b05ce3017acc8c94644257457d7991a9f829

SHA256
05f84306d3b0df2af5221ff91757e1bf1ad5f3339d2ab268b9ccf11455ac7b03

SHA512
8ceb9f011e7fad0311db486f3cfeebefa8227a0f62142708698694deafac4a67303a6ca106af7f395c12786d030d6528dd72d60ef1f4d80c4ae53e7ee5338b46

Download Submit
C:\Windows\{543E0744-2C8E-4576-8BC7-3A2E7C8829CF}.exe

Filesize
197KB

MD5
5ba4a4f330e14803631bd6a14a9d6f26

SHA1
d693a478252aad4a26444613882e3cc404da18d3

SHA256
562110814c832ef81ab99a1c8379a9188739a50a472e4d44588f1fdc62bc72d6

SHA512
64a61a9badb3cc0dbfa6b4cf585d028105cfce43a055d65a857116a3b4088e37cc584b078c933b4e22d04c517cdd98d4cc99ac10a0a225579ea854094d4bb63a

Download Submit
C:\Windows\{8599FAD8-E74C-470e-AC64-D3ED15BFAC8C}.exe

Filesize
197KB

MD5
759b5c02ce077311b90b8c60412db72d

SHA1
ca9528dfbeddad16a7fa6c959789727e5c22f84c

SHA256
f12de04e28e78abcabe79e7fc9f3c3dca93d81d10286bc859a75b1a042c0320b

SHA512
8e703198689a655463251783e3e06d783e35fcc970a758c49812e6de50b858e706b57ee578add76176feb9014fc8be970f5532f6c7000feafa986f7dc94c167a

Download Submit
C:\Windows\{AE6D3478-8B5A-4b2c-B1B2-3A827E16E25D}.exe

Filesize
197KB

MD5
484d423f3930755d5d336c402e79d9ee

SHA1
1f55ce081537104cab60335f60ee2cd1e09a7670

SHA256
01e279a07b531efa92f9787aaecb89e8f0013cb90bf6b2e2628ec509be6d0a69

SHA512
cd0a4975b65417246fce126101ab2f3c919fc9156799ce391ca00c69eb5d6f11612355d8d0fe809c5737e3670c5d6aa2ef5140cd67a4c0225f4b8c8824b7bdbf

Download Submit
C:\Windows\{F53A72A7-3F94-4e4c-A18C-6BE87CAD9228}.exe

Filesize
197KB

MD5
3ab9fc8258bc6f60568889657dd6ea6d

SHA1
cb93bd957213ec280996c230928cf7d86aae0296

SHA256
2ff0611815fa79beb863b2507a996a050691ecf4fabde2170e3539edd854e8de

SHA512
0ab09cf20f424faf08ce0df5682a728b981367e9b3e2ae235951219d10a4bea550291164fc7e7568fa847cf9486938f0173c65dc0f868ac7b5ab704fef8c2e2b

Download Submit
C:\Windows\{F61DC6FC-B5BE-4d8d-83B2-0CE2705DC491}.exe

Filesize
197KB

MD5
d746becfe77d0bbdbce322cd954a1877

SHA1
552988d0500abc9d684183e3b4cc51f7d78f33d4

SHA256
9861504720b51a0efcf671114c1d5704b90ccbbfe71d21962834274b7228bace

SHA512
1faf370d6362434bec5dd72d6c2059c2b6053ca75dc7f3ff706e6f471196c70f6893917707289983f92ffbb5a9bea4da7418317bb60b175a8afb40d7498f8374

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads