c2635f101a56c0c643b11815c9819924569751db7b524acd8ff6f3bcac984332

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
Size

408KB
MD5

0dc3faeb2f4e6f92019c6d3002a3fb25
SHA1

c409e6ae8f6d26909d6959de18999e5573d1df41
SHA256

c2635f101a56c0c643b11815c9819924569751db7b524acd8ff6f3bcac984332
SHA512

97be2953be4cb590d472edff4ab670c2ddb8be84ef3f2a36073de03c77ac8dd0f14a6bb7f0482f29c29d36777a11374f3dcab21c3c2b32ccda1dd8188aa88833
SSDEEP

3072:CEGh0oSl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGsldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000122de-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122de-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122de-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122e4-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122de-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122e4-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a5a-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122e4-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a5a-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000122e4-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a5a-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000122e4-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a5a-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBE7409E-AD85-4138-9AE4-271DD138C527}	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB3EC953-D4A3-4619-82F5-727380DC81D5}	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}\stubpath = "C:\\Windows\\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe"	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}	{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB3EC953-D4A3-4619-82F5-727380DC81D5}\stubpath = "C:\\Windows\\{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe"	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}\stubpath = "C:\\Windows\\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe"	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48ACF501-F311-4051-92A2-49C76FA0EC08}\stubpath = "C:\\Windows\\{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe"	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9989A23-0F06-44e8-A910-49FA392A77FB}	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9989A23-0F06-44e8-A910-49FA392A77FB}\stubpath = "C:\\Windows\\{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe"	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}\stubpath = "C:\\Windows\\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe"	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBE7409E-AD85-4138-9AE4-271DD138C527}\stubpath = "C:\\Windows\\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe"	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48ACF501-F311-4051-92A2-49C76FA0EC08}	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}\stubpath = "C:\\Windows\\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe"	{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}\stubpath = "C:\\Windows\\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe"	{81DBA74B-4440-415c-BA18-4C556880286A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}\stubpath = "C:\\Windows\\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe"	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81DBA74B-4440-415c-BA18-4C556880286A}	{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81DBA74B-4440-415c-BA18-4C556880286A}\stubpath = "C:\\Windows\\{81DBA74B-4440-415c-BA18-4C556880286A}.exe"	{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}	{81DBA74B-4440-415c-BA18-4C556880286A}.exe

Executes dropped EXE 11 IoCs

pid	Process
1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
2008	{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
2792	{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
488	{81DBA74B-4440-415c-BA18-4C556880286A}.exe
652	{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
File created	C:\Windows\{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
File created	C:\Windows\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
File created	C:\Windows\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
File created	C:\Windows\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe	{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
File created	C:\Windows\{81DBA74B-4440-415c-BA18-4C556880286A}.exe	{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
File created	C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
File created	C:\Windows\{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
File created	C:\Windows\{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
File created	C:\Windows\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
File created	C:\Windows\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe	{81DBA74B-4440-415c-BA18-4C556880286A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
Token: SeIncBasePriorityPrivilege	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
Token: SeIncBasePriorityPrivilege	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
Token: SeIncBasePriorityPrivilege	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
Token: SeIncBasePriorityPrivilege	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
Token: SeIncBasePriorityPrivilege	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
Token: SeIncBasePriorityPrivilege	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
Token: SeIncBasePriorityPrivilege	2008	{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
Token: SeIncBasePriorityPrivilege	2792	{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
Token: SeIncBasePriorityPrivilege	488	{81DBA74B-4440-415c-BA18-4C556880286A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1948	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	28
PID 1868 wrote to memory of 1948	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	28
PID 1868 wrote to memory of 1948	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	28
PID 1868 wrote to memory of 1948	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	28
PID 1868 wrote to memory of 2964	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	29
PID 1868 wrote to memory of 2964	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	29
PID 1868 wrote to memory of 2964	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	29
PID 1868 wrote to memory of 2964	1868	2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe	29
PID 1948 wrote to memory of 2664	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	31
PID 1948 wrote to memory of 2664	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	31
PID 1948 wrote to memory of 2664	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	31
PID 1948 wrote to memory of 2664	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	31
PID 1948 wrote to memory of 2592	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	30
PID 1948 wrote to memory of 2592	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	30
PID 1948 wrote to memory of 2592	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	30
PID 1948 wrote to memory of 2592	1948	{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe	30
PID 2664 wrote to memory of 2600	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	32
PID 2664 wrote to memory of 2600	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	32
PID 2664 wrote to memory of 2600	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	32
PID 2664 wrote to memory of 2600	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	32
PID 2664 wrote to memory of 2624	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	33
PID 2664 wrote to memory of 2624	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	33
PID 2664 wrote to memory of 2624	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	33
PID 2664 wrote to memory of 2624	2664	{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe	33
PID 2600 wrote to memory of 2436	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	35
PID 2600 wrote to memory of 2436	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	35
PID 2600 wrote to memory of 2436	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	35
PID 2600 wrote to memory of 2436	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	35
PID 2600 wrote to memory of 2468	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	34
PID 2600 wrote to memory of 2468	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	34
PID 2600 wrote to memory of 2468	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	34
PID 2600 wrote to memory of 2468	2600	{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe	34
PID 2436 wrote to memory of 2188	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	38
PID 2436 wrote to memory of 2188	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	38
PID 2436 wrote to memory of 2188	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	38
PID 2436 wrote to memory of 2188	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	38
PID 2436 wrote to memory of 2164	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	39
PID 2436 wrote to memory of 2164	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	39
PID 2436 wrote to memory of 2164	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	39
PID 2436 wrote to memory of 2164	2436	{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe	39
PID 2188 wrote to memory of 2412	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	41
PID 2188 wrote to memory of 2412	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	41
PID 2188 wrote to memory of 2412	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	41
PID 2188 wrote to memory of 2412	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	41
PID 2188 wrote to memory of 1216	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	40
PID 2188 wrote to memory of 1216	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	40
PID 2188 wrote to memory of 1216	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	40
PID 2188 wrote to memory of 1216	2188	{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe	40
PID 2412 wrote to memory of 1556	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	43
PID 2412 wrote to memory of 1556	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	43
PID 2412 wrote to memory of 1556	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	43
PID 2412 wrote to memory of 1556	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	43
PID 2412 wrote to memory of 2376	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	42
PID 2412 wrote to memory of 2376	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	42
PID 2412 wrote to memory of 2376	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	42
PID 2412 wrote to memory of 2376	2412	{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe	42
PID 1556 wrote to memory of 2008	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	44
PID 1556 wrote to memory of 2008	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	44
PID 1556 wrote to memory of 2008	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	44
PID 1556 wrote to memory of 2008	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	44
PID 1556 wrote to memory of 2496	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	45
PID 1556 wrote to memory of 2496	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	45
PID 1556 wrote to memory of 2496	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	45
PID 1556 wrote to memory of 2496	1556	{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_0dc3faeb2f4e6f92019c6d3002a3fb25_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
  C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EBE74~1.EXE > nul
    3⤵
    PID:2592
- - C:\Windows\{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
    C:\Windows\{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
      C:\Windows\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60667~1.EXE > nul
        5⤵
        
        PID:2468
    - - C:\Windows\{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
        
        C:\Windows\{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Windows\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
        
        C:\Windows\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5013~1.EXE > nul
        7⤵
        
        PID:1216
        
        C:\Windows\{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
        
        C:\Windows\{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A9989~1.EXE > nul
        8⤵
        
        PID:2376
        
        C:\Windows\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
        
        C:\Windows\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
        
        C:\Windows\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
        
        C:\Windows\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\{81DBA74B-4440-415c-BA18-4C556880286A}.exe
        
        C:\Windows\{81DBA74B-4440-415c-BA18-4C556880286A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
        
        C:\Windows\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe
        
        C:\Windows\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe
        12⤵
        Executes dropped EXE
        
        PID:652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81DBA~1.EXE > nul
        12⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1813C~1.EXE > nul
        11⤵
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{677E7~1.EXE > nul
        10⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE01E~1.EXE > nul
        9⤵
        
        PID:2496
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48ACF~1.EXE > nul
        6⤵
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AB3EC~1.EXE > nul
      4⤵
      PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1813C82F-9DD6-443c-A6BC-E55CD8201ECE}.exe

Filesize
408KB

MD5
5b359b569a59b7c5ae172cea303f883b

SHA1
4cec149d239441c86c3cb5f52b9a0df27467d96d

SHA256
a4e8d8f3306c2fc3199e02d42d56e416ff1b7d5e98e42f9b376e87fcd1320505

SHA512
3cfbf803b7a268745bc7a8eeeaa208d3e058e7fc2e3a50fa08b1a4aba4caa229842399639c7d35bda570d3b4e85999eee097356affdb3caee845a3da5aedc666

Download Submit
C:\Windows\{48ACF501-F311-4051-92A2-49C76FA0EC08}.exe

Filesize
408KB

MD5
c3840b9564ecde1dc6bb05e4d8666e93

SHA1
6f7eb3b5f1ff7a12a489b8b0e4225ddec2f30008

SHA256
d64bed78e07e9795db05df348ecb6cb008ee1545292b398a451ddd32846a3aff

SHA512
3b24f642d51e94fc735adf5c0544ede53e62614af104cb608f2a2b6df934e639ea21f9d1e54418ec69d909ff7a849777e285c687c068166650b2fbb4056aedaf

Download Submit
C:\Windows\{60667D9F-6EF1-40e2-BB2F-2B8AA2FA29F9}.exe

Filesize
408KB

MD5
ee5dc714c685fd1f7b40ccb517757a4b

SHA1
c775cb5249b3a64750971555e90b2408aa7a5ad0

SHA256
922ef10146aadec74d7d40740fd0d2caa754f2872bca567fc3dbb563a1bfef0d

SHA512
d2f8f7560fe45bdc64951e390a537aaae206e9f3e81d77a56da2756832d29d326827af99a3671e90b2fc9aaf1fcc57781f8076e444d877dd581fd6d892e9fa1b

Download Submit
C:\Windows\{677E789B-6B09-45ca-8E43-83E7B4C8FCEA}.exe

Filesize
408KB

MD5
a6c2cbdfa5a59049e5aebf3eae614964

SHA1
990694b1ab83a6b6e0a1c58fa6439eefafe991a5

SHA256
d96face2c94721600bd9bfa0069561db711f5acb461d4d13ba3e50f154c7a99c

SHA512
5cd5a26070092ec32404ba50ca00fe8da93c2a474defd71c7e989ccf7b788da9bf1ca156d3cbc2006d13fccfc9202c58210735951672c4f23dba9e59c1ce87ef

Download Submit
C:\Windows\{81DBA74B-4440-415c-BA18-4C556880286A}.exe

Filesize
408KB

MD5
3fd1bf00bda29ce0ca57011c1156cc58

SHA1
64770c76176e3d89259cfdf3d45ed15e9389fcf6

SHA256
0febb106e1129f791bd4605dd065e605c6dd79d271fbf115895d73d3a8c6154e

SHA512
6bade1ca750d05471f2c9756c12ae507bd933e61cd81cb70508a49d7e34cf9d70c8415813e6c3d393357be29b88690a299613b98e1998044a5fc6cd062a5d868

Download Submit
C:\Windows\{A9989A23-0F06-44e8-A910-49FA392A77FB}.exe

Filesize
408KB

MD5
733a98c1e20b431e57f4282b848a963c

SHA1
f40c744a200f046a7cbb780c8c94625f95e03319

SHA256
f3fa05df6579cae4984a816a5c437b986b42a7999c5dea9236dd477fbc873dd8

SHA512
3d932a4e8619f1177b3fe46aee51873a792ee3816eb6ccbf0d68e2016bbe960b2836a2503ef09dbdadb8ead8f792d63adeb68f0413244ebfe728b5f9d850f873

Download Submit
C:\Windows\{AB3EC953-D4A3-4619-82F5-727380DC81D5}.exe

Filesize
408KB

MD5
23b9f5dcf6120a12eee672154655bd1d

SHA1
46dcb28a6ee34fdaa724a3e739998b66747cc3b1

SHA256
7609ff8129165bda9bb4df42e1c00901244dd51c89968c8454465b84125c62f5

SHA512
77966d8f8ab1a07cd2182b2e113d35440b07f95940f872f7b7ad2bc2d9d0299821364c34fb03b25f97a946926d955e66b11ff4a8585fbf4e5c14b56004b1b367

Download Submit
C:\Windows\{C5013A0E-D2FB-4f1a-8E53-E90B37AFEA5D}.exe

Filesize
408KB

MD5
fe75af441288410d0cc513f908d5e6b8

SHA1
d3d7abf4ab026d643fe501dfedc490a441ff0960

SHA256
3fef59c84192296f8842a49cfd4705dacb7e7440e916fa72eea8ab197157a254

SHA512
308f990a666cbcf60de06decd71907c00df964031deb6d0b20ee364b22ff1829a74b201337a84f8228bb692c4258433077832be0a53dc522b9b259a1b4b8d0f3

Download Submit
C:\Windows\{D00BE992-C397-4405-B6CE-9E8D4E2266C5}.exe

Filesize
408KB

MD5
239db9854861e4eb49f80d002aca959e

SHA1
e142133044afa6aff74b615ac613b873ff8e22f9

SHA256
23794e2f97146e6735e24e691a46a71900863e08d1bc74a144e6394a9309cd71

SHA512
69132a9b228fdfb152b26d4d8533695f02dd67fa01eb925f21597307b3ff1ff23ed90a880d416ad7a29c21e4bc6b1c9046af151c8d6931e55a6a584d2d039376

Download Submit
C:\Windows\{DE01EA5C-F79F-48ac-8E80-4DAC9866535E}.exe

Filesize
408KB

MD5
03dd4b123848aa726262e6088e974313

SHA1
993a747e748632044afc2166238812d4845db347

SHA256
922b260476ae01f8548785aa69ac9274b131a0e482e12fed7ab8666753765e7a

SHA512
43bb8d6cf115896f7ac5324967843d3b5f95ec2d1db5634e7f95fecaf325603f4c2046c4b2928880262796bf35c1ac577b93a6c40624a97f1cdbbfacaec04cf9

Download Submit
C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe

Filesize
320KB

MD5
9aaaeb08652bf16c5e788373856fb903

SHA1
e23199a166ab9204f200188a191d55e6533e474e

SHA256
72192f8d9d24ae3183ede5297ae91e28ba5b018048773fa70279fa7d580a474e

SHA512
d300fff4d19f4d77fc6f03b8ee6783b9f2f0218f93a3e2dc76f16270f3e55ae47c752e98c4a602969ffcd66c23e17227cacc372c7b40099aef10aa2ca03ba4a3

Download Submit
C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe

Filesize
367KB

MD5
8c02e58b26efa2bb553202a7accff37f

SHA1
d7f1eccff561ec0c5254dfc333250203a5cf3949

SHA256
776e22a98d1d5a37ecde984729d6f06f0a086a697e66837ec9b8706c401ac195

SHA512
cebc89f758a4a81a3839ae7c14ed987787e95ed03f66c8c2284f5715d17f97104b9a01ac39a3cfcc0664a712c095818a5105b58ce8b7e6af0f9d0b1f291f5965

Download Submit
C:\Windows\{EBE7409E-AD85-4138-9AE4-271DD138C527}.exe

Filesize
408KB

MD5
86be8ff85850a25c7d14eaf9ca5f9e34

SHA1
54a51b1176e1e8940b8be8a582628aefe8358d62

SHA256
ab61ba67878b552e2cca3226cda9eb5a1c466fc5626087c425e19b38e6295212

SHA512
fe9d9d66610c01077c3257efb28a3d3df1a13fa756595068b82f1bff14a1df7807a07ef3904278db3887ab15502825c7d44acfa116d4d931a6c76fc5f954d696

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads