dabaa055075d1de42bd78aa2a2acdd4fb96d6d59b029660dfe8c72e86e86a79e

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
Size

197KB
MD5

d7f238d12447baa63d3ab477f5d5cfa5
SHA1

9963c05591b88b4bc89ea1dd4cba922d39085a46
SHA256

dabaa055075d1de42bd78aa2a2acdd4fb96d6d59b029660dfe8c72e86e86a79e
SHA512

afd1ff11b2a080754722facddccdd68c8ad29971ec00fa61d2d860c7ed27520e4fc2838f3577a4e9db4515d36d7e6298ec5c004ddc1e8728277530a8cd04465b
SSDEEP

3072:jEGh0oGl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGolEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000800000000b529-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000b529-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000b529-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000000b529-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000000b529-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000000b529-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7576E1C5-1050-4d3b-B259-0D16AAF50485}	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C580D43-075C-441a-8F68-CFC213A6D9E4}\stubpath = "C:\\Windows\\{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe"	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0383F452-70E5-4303-9671-12C96FB43E2D}	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7234E710-B844-4d17-9EFD-6EFAB927D856}	{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0383F452-70E5-4303-9671-12C96FB43E2D}\stubpath = "C:\\Windows\\{0383F452-70E5-4303-9671-12C96FB43E2D}.exe"	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B349C027-F0C6-4612-8A30-E90502AA9A45}	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}\stubpath = "C:\\Windows\\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe"	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7576E1C5-1050-4d3b-B259-0D16AAF50485}\stubpath = "C:\\Windows\\{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe"	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C580D43-075C-441a-8F68-CFC213A6D9E4}	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}\stubpath = "C:\\Windows\\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe"	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}\stubpath = "C:\\Windows\\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe"	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}	{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}\stubpath = "C:\\Windows\\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe"	{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}\stubpath = "C:\\Windows\\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe"	{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}\stubpath = "C:\\Windows\\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe"	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B349C027-F0C6-4612-8A30-E90502AA9A45}\stubpath = "C:\\Windows\\{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe"	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7234E710-B844-4d17-9EFD-6EFAB927D856}\stubpath = "C:\\Windows\\{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe"	{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}	{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe

Deletes itself 1 IoCs

pid	Process
1212	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
2140	{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
1288	{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
1244	{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe
2824	{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
File created	C:\Windows\{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
File created	C:\Windows\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
File created	C:\Windows\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe	{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
File created	C:\Windows\{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
File created	C:\Windows\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
File created	C:\Windows\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
File created	C:\Windows\{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe	{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
File created	C:\Windows\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe	{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe
File created	C:\Windows\{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
File created	C:\Windows\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
Token: SeIncBasePriorityPrivilege	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
Token: SeIncBasePriorityPrivilege	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
Token: SeIncBasePriorityPrivilege	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
Token: SeIncBasePriorityPrivilege	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
Token: SeIncBasePriorityPrivilege	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
Token: SeIncBasePriorityPrivilege	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
Token: SeIncBasePriorityPrivilege	2140	{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
Token: SeIncBasePriorityPrivilege	1288	{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
Token: SeIncBasePriorityPrivilege	1244	{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3016	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	28
PID 1696 wrote to memory of 3016	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	28
PID 1696 wrote to memory of 3016	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	28
PID 1696 wrote to memory of 3016	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	28
PID 1696 wrote to memory of 1212	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	29
PID 1696 wrote to memory of 1212	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	29
PID 1696 wrote to memory of 1212	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	29
PID 1696 wrote to memory of 1212	1696	2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe	29
PID 3016 wrote to memory of 568	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	32
PID 3016 wrote to memory of 568	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	32
PID 3016 wrote to memory of 568	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	32
PID 3016 wrote to memory of 568	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	32
PID 3016 wrote to memory of 2704	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	33
PID 3016 wrote to memory of 2704	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	33
PID 3016 wrote to memory of 2704	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	33
PID 3016 wrote to memory of 2704	3016	{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe	33
PID 568 wrote to memory of 2728	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	34
PID 568 wrote to memory of 2728	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	34
PID 568 wrote to memory of 2728	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	34
PID 568 wrote to memory of 2728	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	34
PID 568 wrote to memory of 2796	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	35
PID 568 wrote to memory of 2796	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	35
PID 568 wrote to memory of 2796	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	35
PID 568 wrote to memory of 2796	568	{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe	35
PID 2728 wrote to memory of 2780	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	37
PID 2728 wrote to memory of 2780	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	37
PID 2728 wrote to memory of 2780	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	37
PID 2728 wrote to memory of 2780	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	37
PID 2728 wrote to memory of 2116	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	36
PID 2728 wrote to memory of 2116	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	36
PID 2728 wrote to memory of 2116	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	36
PID 2728 wrote to memory of 2116	2728	{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe	36
PID 2780 wrote to memory of 2560	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	39
PID 2780 wrote to memory of 2560	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	39
PID 2780 wrote to memory of 2560	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	39
PID 2780 wrote to memory of 2560	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	39
PID 2780 wrote to memory of 2520	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	38
PID 2780 wrote to memory of 2520	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	38
PID 2780 wrote to memory of 2520	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	38
PID 2780 wrote to memory of 2520	2780	{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe	38
PID 2560 wrote to memory of 2220	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	40
PID 2560 wrote to memory of 2220	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	40
PID 2560 wrote to memory of 2220	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	40
PID 2560 wrote to memory of 2220	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	40
PID 2560 wrote to memory of 3060	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	41
PID 2560 wrote to memory of 3060	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	41
PID 2560 wrote to memory of 3060	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	41
PID 2560 wrote to memory of 3060	2560	{0383F452-70E5-4303-9671-12C96FB43E2D}.exe	41
PID 2220 wrote to memory of 2400	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	42
PID 2220 wrote to memory of 2400	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	42
PID 2220 wrote to memory of 2400	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	42
PID 2220 wrote to memory of 2400	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	42
PID 2220 wrote to memory of 1764	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	43
PID 2220 wrote to memory of 1764	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	43
PID 2220 wrote to memory of 1764	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	43
PID 2220 wrote to memory of 1764	2220	{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe	43
PID 2400 wrote to memory of 2140	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	44
PID 2400 wrote to memory of 2140	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	44
PID 2400 wrote to memory of 2140	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	44
PID 2400 wrote to memory of 2140	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	44
PID 2400 wrote to memory of 1820	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	45
PID 2400 wrote to memory of 1820	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	45
PID 2400 wrote to memory of 1820	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	45
PID 2400 wrote to memory of 1820	2400	{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d7f238d12447baa63d3ab477f5d5cfa5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
  C:\Windows\{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
    C:\Windows\{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
      C:\Windows\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0BDC~1.EXE > nul
        5⤵
        
        PID:2116
    - - C:\Windows\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
        
        C:\Windows\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13FDB~1.EXE > nul
        6⤵
        
        PID:2520
      - C:\Windows\{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
        
        C:\Windows\{0383F452-70E5-4303-9671-12C96FB43E2D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
        
        C:\Windows\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
        
        C:\Windows\{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
        
        C:\Windows\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
        
        C:\Windows\{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7234E~1.EXE > nul
        11⤵
        
        PID:2860
        
        C:\Windows\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe
        
        C:\Windows\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C0A21~1.EXE > nul
        12⤵
        
        PID:2472
        
        C:\Windows\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe
        
        C:\Windows\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe
        12⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0DD49~1.EXE > nul
        10⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B349C~1.EXE > nul
        9⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5C0CC~1.EXE > nul
        8⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0383F~1.EXE > nul
        7⤵
        
        PID:3060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2C580~1.EXE > nul
      4⤵
      PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7576E~1.EXE > nul
    3⤵
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0383F452-70E5-4303-9671-12C96FB43E2D}.exe

Filesize
197KB

MD5
c37d4c525523d7d023e99d1b62c02390

SHA1
cfb8b28d6e73bad0ba39e9a9e691e34c2af9331f

SHA256
acf1aded8e325b24abcecd266267dd844d7dc66ec7f63c1801ed2d4f24f9d786

SHA512
39a3d3676238ae815768c341b309704ca210f7cb5b033f2803a31d7ec3323c06151a8012ed234ce4f6c5690e55753db1d0f89d33bf08f7deb585ce8e7f33d80e

Download Submit
C:\Windows\{0DD49923-2F43-4168-B43F-F78D28D3D7AF}.exe

Filesize
197KB

MD5
0084443fb8375d1ac79f5b5a16e3b8f6

SHA1
d59e5e4cfe11f1f609abdaa0009540a551c0cf39

SHA256
d5d23e326b38aa937a1574d28da9ef6e37f5b866baf3ae70a5cf6d98b92f1e7d

SHA512
d6ea785ebad6c2df1ec1e3da4e76c04b8d2b378930130d5163823522f66a66cacca9a93d03408d2bb779d8556b735b58ae81ba6d8bf6a8ab1e4fb4a64b10465a

Download Submit
C:\Windows\{1299EA12-35E8-4ad8-A876-5A62E02BA35C}.exe

Filesize
197KB

MD5
18cab39feea4872823530ac6f7cb234f

SHA1
032dddc6888c06f32fc5ee7f11bc4e017324fe3a

SHA256
9655bc57db40d5fbe406f02fd756c8194e3c9b94fa37aec9d21d5c2ed4e5cf15

SHA512
e70db0b951a932d325338e08babdee4d3f4ae95c618c256caeb3da59b38f8cdbcd0d0bcd6b51b417bf7b1cfc623bcdd52b62a22e0df992d67c0490b00e8a56a4

Download Submit
C:\Windows\{13FDB7DB-22AD-4158-BD6E-7191F422FEC7}.exe

Filesize
197KB

MD5
0f9e769a9a2c356427df7269ecaa1013

SHA1
dc2b984af703ed7c54df18f101c6ec4e4b9c7576

SHA256
467920fbf61e35b69e2024ee220f86b86816649f00a1d70e87e213834cca2873

SHA512
30bbfefeb28b2d42fa12a02961199798c272dfe2c7d32f31918b3e04a8c19cbf42ef7edce29823200f9571b7b07506e511736de4bd4500a9f8daa11036e5952c

Download Submit
C:\Windows\{2C580D43-075C-441a-8F68-CFC213A6D9E4}.exe

Filesize
197KB

MD5
92914be0c7809f092655d140e2efd62e

SHA1
6e45c1237035e0279859f1c8221a406f0a9a4fa5

SHA256
0f1bd4a051e20928625ab2512e6eb67e3e691b8899a119f30fa1e5967dfeadd9

SHA512
ce61387befafbb536cecaa45ddf5fa22d45dd159e95f1cf89747582c919e79e809c2d11b1d0c95e0ef8f61f16005cd94d248a3310402ff61c923553cac83f4cd

Download Submit
C:\Windows\{5C0CC7BB-B0E9-4d42-863F-A19A25AD24CC}.exe

Filesize
197KB

MD5
6d0984ed14ad43c919f5e6a61e497ca3

SHA1
5a2639af9e921bbd88903e1682e953783e5ae4da

SHA256
911cabea2be65a47b34072612c3ce8383f963982d2393ec35553c02c955c0863

SHA512
d4bbe01a7f6147afa1b640556485f2d1ac558296dc599ad2d283421e18611fb07d51951b300e0b640f7575c96f714b590bde8185387105973f251ecb35c1ffc1

Download Submit
C:\Windows\{7234E710-B844-4d17-9EFD-6EFAB927D856}.exe

Filesize
197KB

MD5
bb28fa3ab262fb22f7f9a9afb93bccec

SHA1
47649e9be42edf1ffa8359790e9480eb3ed8d607

SHA256
9e110192584704e575e3e97a03083621513e4b1470b2b826f2ee6cb3c330a37e

SHA512
905d21815816cac6ccd43012b866e19ba622c1cb003f5abf736f9f7745a8e7fcc4d363a85616d288d90a69095d1f4bcc1354cd03848750a9a5a0b6e79b0a7415

Download Submit
C:\Windows\{7576E1C5-1050-4d3b-B259-0D16AAF50485}.exe

Filesize
197KB

MD5
acb5110187650b053574bbf4215d810c

SHA1
6e6f0e8b887c91d2ac36194b3a197f6fc9ed03b0

SHA256
0c09499d0bb30d838e871bf14c18a12da97bf23bf4db8440b3b1a9bddc1ce9ea

SHA512
4d9adc5410f3541b4b67872a8a38abaffd976b6ff2f5d57b2b3858664c09b6e039085c1766274554a5d1bf5069d9d9a4077f6dba4f821b4464d98d27b22bd07b

Download Submit
C:\Windows\{B0BDC9BB-82B4-4138-8BB7-BB35BD040549}.exe

Filesize
197KB

MD5
9b9e906cb657e2e0781ea6496335d4ae

SHA1
877e1e2e1693da8d0767fee724bc6f7086a08705

SHA256
2404393efb85d84f61d97532790dfe6244413d619e66266b76efc4d617d2de37

SHA512
f5cc3477b74ac514acafa6cefeda81b21200ec0fb06b758db63cb7c24ae70adb7cfe373ad9ac4c099055f1a783cfecfa1a32109eaa13bdd4fc8d3cb60252f6a2

Download Submit
C:\Windows\{B349C027-F0C6-4612-8A30-E90502AA9A45}.exe

Filesize
197KB

MD5
01d6e937aaab63041ab6ee0b28ee06fb

SHA1
a8490c041da0967062acc543e8de24311b94b9ca

SHA256
b819d11a2db970eaeb46ade3a1ba2a912682f6d59f1dad872832cf88cbf61222

SHA512
d5221eed355744b12a61290b7a1ba8237cdaacb8cef1724186d9bd95c32d8fd244f5ca0a3ff0163c6f1adcca5531e3252591b0ac4f7ef9952de8b7460c3a01e4

Download Submit
C:\Windows\{C0A21F2C-E347-40c5-AA5E-FAC30DF6302C}.exe

Filesize
197KB

MD5
e15c695b5728885b2ec1702b7ec1168e

SHA1
60c781b3c28f5a24785514d3a07ef132281c110c

SHA256
2885c0796bce705bfff23d12037b4fd8516206538840281858fa9e7cbca45b65

SHA512
f7e78fcdbd2517ae8a395801ac78af75a27ed3a05167c7f2d0dd03043bb15e425cec954351072746103df5c0dad2b98a951dbbfb3e6bbacc7997327c1fae61e0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads