a0dc464d4cce80c660597babf8923ad92308d4a14fafaa54cdc7670e09dd7955

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
Size

372KB
MD5

ba912d46e1acfaf79d03097f09a2702c
SHA1

5498bf61a4d1dd745ffd368f4322cd1fd2484032
SHA256

a0dc464d4cce80c660597babf8923ad92308d4a14fafaa54cdc7670e09dd7955
SHA512

d2c2ae47d101fa2645acfe9a7e4c04fc6d05f6820971cf8f8fae396c17ba8f2345c62b7e1908bc6848601c94ab07e6ac63296a382e35dde2130855fc057b5f44
SSDEEP

3072:CEGh0o1mlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEG+l/Oe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012281-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002b000000015c1c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f7-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-62.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4256BE8D-89BF-470c-BF07-975D1302F613}\stubpath = "C:\\Windows\\{4256BE8D-89BF-470c-BF07-975D1302F613}.exe"	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC04DF75-B70F-4349-BB4D-8527F1446938}\stubpath = "C:\\Windows\\{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe"	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D39524EA-A969-4896-BED0-AC9B3702A241}	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}	{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70F64A43-3318-4bcf-AAEC-786F8240203B}\stubpath = "C:\\Windows\\{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe"	{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204046ED-4538-4740-B41C-0CEF24082813}	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204046ED-4538-4740-B41C-0CEF24082813}\stubpath = "C:\\Windows\\{204046ED-4538-4740-B41C-0CEF24082813}.exe"	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C3C2157-0D30-4fb0-B373-5170F15179BB}	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D39524EA-A969-4896-BED0-AC9B3702A241}\stubpath = "C:\\Windows\\{D39524EA-A969-4896-BED0-AC9B3702A241}.exe"	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}\stubpath = "C:\\Windows\\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe"	{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}\stubpath = "C:\\Windows\\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe"	{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33C06764-CF96-4c23-9BED-BA414C102AA9}\stubpath = "C:\\Windows\\{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe"	{204046ED-4538-4740-B41C-0CEF24082813}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6C3C2157-0D30-4fb0-B373-5170F15179BB}\stubpath = "C:\\Windows\\{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe"	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}\stubpath = "C:\\Windows\\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe"	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70F64A43-3318-4bcf-AAEC-786F8240203B}	{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4256BE8D-89BF-470c-BF07-975D1302F613}	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC04DF75-B70F-4349-BB4D-8527F1446938}	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}\stubpath = "C:\\Windows\\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe"	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33C06764-CF96-4c23-9BED-BA414C102AA9}	{204046ED-4538-4740-B41C-0CEF24082813}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}	{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe

Deletes itself 1 IoCs

pid	Process
2688	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe
2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
2748	{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
1552	{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
1296	{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe
988	{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{204046ED-4538-4740-B41C-0CEF24082813}.exe	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
File created	C:\Windows\{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
File created	C:\Windows\{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
File created	C:\Windows\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
File created	C:\Windows\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe	{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
File created	C:\Windows\{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe	{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
File created	C:\Windows\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe	{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe
File created	C:\Windows\{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	{204046ED-4538-4740-B41C-0CEF24082813}.exe
File created	C:\Windows\{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
File created	C:\Windows\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
File created	C:\Windows\{D39524EA-A969-4896-BED0-AC9B3702A241}.exe	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe
Token: SeIncBasePriorityPrivilege	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
Token: SeIncBasePriorityPrivilege	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
Token: SeIncBasePriorityPrivilege	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
Token: SeIncBasePriorityPrivilege	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
Token: SeIncBasePriorityPrivilege	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
Token: SeIncBasePriorityPrivilege	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
Token: SeIncBasePriorityPrivilege	2748	{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
Token: SeIncBasePriorityPrivilege	1552	{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
Token: SeIncBasePriorityPrivilege	1296	{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1908	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	28
PID 1080 wrote to memory of 1908	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	28
PID 1080 wrote to memory of 1908	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	28
PID 1080 wrote to memory of 1908	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	28
PID 1080 wrote to memory of 2688	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	29
PID 1080 wrote to memory of 2688	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	29
PID 1080 wrote to memory of 2688	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	29
PID 1080 wrote to memory of 2688	1080	2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe	29
PID 1908 wrote to memory of 2568	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	30
PID 1908 wrote to memory of 2568	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	30
PID 1908 wrote to memory of 2568	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	30
PID 1908 wrote to memory of 2568	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	30
PID 1908 wrote to memory of 2816	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	31
PID 1908 wrote to memory of 2816	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	31
PID 1908 wrote to memory of 2816	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	31
PID 1908 wrote to memory of 2816	1908	{204046ED-4538-4740-B41C-0CEF24082813}.exe	31
PID 2568 wrote to memory of 2680	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	34
PID 2568 wrote to memory of 2680	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	34
PID 2568 wrote to memory of 2680	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	34
PID 2568 wrote to memory of 2680	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	34
PID 2568 wrote to memory of 1212	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	35
PID 2568 wrote to memory of 1212	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	35
PID 2568 wrote to memory of 1212	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	35
PID 2568 wrote to memory of 1212	2568	{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe	35
PID 2680 wrote to memory of 2908	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	37
PID 2680 wrote to memory of 2908	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	37
PID 2680 wrote to memory of 2908	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	37
PID 2680 wrote to memory of 2908	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	37
PID 2680 wrote to memory of 2944	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	36
PID 2680 wrote to memory of 2944	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	36
PID 2680 wrote to memory of 2944	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	36
PID 2680 wrote to memory of 2944	2680	{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe	36
PID 2908 wrote to memory of 2380	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	38
PID 2908 wrote to memory of 2380	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	38
PID 2908 wrote to memory of 2380	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	38
PID 2908 wrote to memory of 2380	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	38
PID 2908 wrote to memory of 2548	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	39
PID 2908 wrote to memory of 2548	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	39
PID 2908 wrote to memory of 2548	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	39
PID 2908 wrote to memory of 2548	2908	{4256BE8D-89BF-470c-BF07-975D1302F613}.exe	39
PID 2380 wrote to memory of 1724	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	41
PID 2380 wrote to memory of 1724	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	41
PID 2380 wrote to memory of 1724	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	41
PID 2380 wrote to memory of 1724	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	41
PID 2380 wrote to memory of 852	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	40
PID 2380 wrote to memory of 852	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	40
PID 2380 wrote to memory of 852	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	40
PID 2380 wrote to memory of 852	2380	{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe	40
PID 1724 wrote to memory of 756	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	42
PID 1724 wrote to memory of 756	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	42
PID 1724 wrote to memory of 756	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	42
PID 1724 wrote to memory of 756	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	42
PID 1724 wrote to memory of 1164	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	43
PID 1724 wrote to memory of 1164	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	43
PID 1724 wrote to memory of 1164	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	43
PID 1724 wrote to memory of 1164	1724	{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe	43
PID 756 wrote to memory of 2748	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	44
PID 756 wrote to memory of 2748	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	44
PID 756 wrote to memory of 2748	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	44
PID 756 wrote to memory of 2748	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	44
PID 756 wrote to memory of 2808	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	45
PID 756 wrote to memory of 2808	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	45
PID 756 wrote to memory of 2808	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	45
PID 756 wrote to memory of 2808	756	{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_ba912d46e1acfaf79d03097f09a2702c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\{204046ED-4538-4740-B41C-0CEF24082813}.exe
  C:\Windows\{204046ED-4538-4740-B41C-0CEF24082813}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
    C:\Windows\{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
      C:\Windows\{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C3C2~1.EXE > nul
        5⤵
        
        PID:2944
    - - C:\Windows\{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
        
        C:\Windows\{4256BE8D-89BF-470c-BF07-975D1302F613}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Windows\{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
        
        C:\Windows\{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FC04D~1.EXE > nul
        7⤵
        
        PID:852
        
        C:\Windows\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
        
        C:\Windows\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
        
        C:\Windows\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
        
        C:\Windows\{D39524EA-A969-4896-BED0-AC9B3702A241}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
        
        C:\Windows\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60396~1.EXE > nul
        11⤵
        
        PID:1892
        
        C:\Windows\{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe
        
        C:\Windows\{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70F64~1.EXE > nul
        12⤵
        
        PID:1384
        
        C:\Windows\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe
        
        C:\Windows\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe
        12⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3952~1.EXE > nul
        10⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53CE1~1.EXE > nul
        9⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F66CF~1.EXE > nul
        8⤵
        
        PID:1164
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4256B~1.EXE > nul
        6⤵
        
        PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{33C06~1.EXE > nul
      4⤵
      PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{20404~1.EXE > nul
    3⤵
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{204046ED-4538-4740-B41C-0CEF24082813}.exe

Filesize
372KB

MD5
d1681548f57a7e905544e3afdae41268

SHA1
196e3a097a9b264689a8251d0823b032c4c2cfb6

SHA256
8872317a370fc34ec1fb0f763f182878ce1fe9e7849e1ee381c18887d73ea704

SHA512
28b858da6065a6bc1bbe0007f6f9ab80b0bb6c37a66dbde3ac088c1a09ffb619a492bddaeb98abcf9a2a25c908a2cc8976c31d6e621229f311eb8c914f1cc8a4

Download Submit
C:\Windows\{33C06764-CF96-4c23-9BED-BA414C102AA9}.exe

Filesize
372KB

MD5
7447b49fdb68a3dead993273d3ac4d5e

SHA1
03c9cf286a09c7829b42f09cf0a662629b34a504

SHA256
b6330b31457a1fa72bcbe748f53a5d4666eeb61694377b61dd3f507edc939c9c

SHA512
b047b154f0f72153fb45bda49f4f0a7fd5071142e284c6642928160fab4505295a5f704bf74eb8a48890ebab2b19e4a6d0f99ca6fb0e8286a4ff71d60fab6834

Download Submit
C:\Windows\{4256BE8D-89BF-470c-BF07-975D1302F613}.exe

Filesize
372KB

MD5
e3116d36623e3d88db9a38f11cfefc54

SHA1
335907a1fb60e0b75d8af476c2722673a8816d31

SHA256
996ad2583b2b438bde837543eaf84130c060ea5378fa21f7bee2cbc888546ca7

SHA512
aa1fc7507e677bf6530f3831fc02c80b35ccb51c7812b6f60ed43fdce6f4b5f4ad5f59cd26b846078164e9bb7bd4ae6e252ed7985d1cc9c2ac4581971725fe45

Download Submit
C:\Windows\{446CF7C2-059F-4a6f-9E34-2A8B32B42CF1}.exe

Filesize
372KB

MD5
239d82296c8c6485c0913f12d97a4032

SHA1
d83f67736731947c3025fcd4d7ac8f5bbdac4b05

SHA256
09d744b070bec3d52d3a821096df789de8dab8002b317c5f7c6078dcea135916

SHA512
e2ed9fe45fd236d54a96e56b13ee12a907718a1607235284056753307dd614be68a03165959ca11c157deccd6f1895d886ab091677bd448cb398e8be3c18c87c

Download Submit
C:\Windows\{53CE17B9-5D5F-4791-A413-4010C7ECF99F}.exe

Filesize
372KB

MD5
c62d8296eacfdc087e9c00f09ef69169

SHA1
5508ff96abdf56037df49387e0a4ece85da10fd0

SHA256
871885ec5d39fd779809fbe204c8be31d588d694b111c3d261c3ccf7047ffbc1

SHA512
e07ff7eccb0667461a6d8c1eeef5e6c211b575812091bc77fead17ff4cd134492b275c5b49ed23e634703426aff56b1fd2d20bc222d71a3289b9c8a46f2b1570

Download Submit
C:\Windows\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe

Filesize
372KB

MD5
3b18815df039bffde436a31c04991c0f

SHA1
26f4de68e522cea93ad5efae7739e0ede137d979

SHA256
fb3df338585fdd8c1bd559e942bd53b606a5ac96abeda28f620d886ad4820649

SHA512
29b029fe1b13cd518806151a841848044ce6727905738e0a2d606ec39375c0a0740b80fadf0fd159c5d79846610e30efed76a8f83019a7cc56bc035322fb9290

Download Submit
C:\Windows\{6039610C-50B8-4cc7-8CF4-6F42B8F780E1}.exe

Filesize
183KB

MD5
2da380725c265b17b0360128fa811e1c

SHA1
c3918750ca56efb7fb1b5201cc9a450dc8affe2c

SHA256
e106325e3cc84662d636d73531eb3fadda65d5683d26a4f3b141076e35d7685d

SHA512
24b7bf8a04a35151239c52cfc594785cc3f96b8a11c689fb3e7fe0df13db81a986d6737fd19f3066c4797aa8e7b7f3e0561c39f49628bb0f83bcd3b78c6f7323

Download Submit
C:\Windows\{6C3C2157-0D30-4fb0-B373-5170F15179BB}.exe

Filesize
372KB

MD5
3c73f7af5954b80e0baf6023885bb4ef

SHA1
49abe7efb3d648e159b8ff83c3f2b19226eeda46

SHA256
8554c68dc2d2be61abd1260bff04aa48c1d9a9f13d8a5fec651caeb258d4f1be

SHA512
ce9b42e9e28e9ca6c734a89c3c50695d96245eb81d201565e692c67de78134adcfcc3d2a8f943d745108d7b3840dfc60b2102167761e6d742c4605ed445abee5

Download Submit
C:\Windows\{70F64A43-3318-4bcf-AAEC-786F8240203B}.exe

Filesize
372KB

MD5
c82363d45350ffc565e77e4dde1981d2

SHA1
09225c83b39e742492ba10fdd9cd514e93e0cc32

SHA256
fc65257a93df557dbfa3004031eb702ed9406af5b89250869ac175ece506d508

SHA512
8572f9656f0529ae1bd3c11065ed5d39a0fda939b2a2e770d028020606cdcf5951378f4534a4bc3385e717e43db75d07b16c614f20ab789ffb110d2484a3e07d

Download Submit
C:\Windows\{D39524EA-A969-4896-BED0-AC9B3702A241}.exe

Filesize
372KB

MD5
e5c8cf745316728b5ae9cf9a5032ace4

SHA1
38dc4d46acd4e39257063086abf0f4685a078346

SHA256
5e14ea9f3faf41b4876454039cf9d26bc26cd4b2c48a8aa579185bb2290563d5

SHA512
ab38d9876927b84a00a992f704e9d3d43098bcadd72faffeff8899054b58acd77f791ccd788232a282466c5202fccff3899fef6b6c16a6dd48a063d9257f6f23

Download Submit
C:\Windows\{F66CF1B8-C598-45ad-82C1-1C1AAC803E2F}.exe

Filesize
372KB

MD5
3da2d172f6b840cbfb992573a1c67fa0

SHA1
4269e1240d93746df18bbbffe2a19aaa596ccdde

SHA256
545370ecafadce51d3c2f99a9d9f8ab16e2a22f92e7b4fd98800644d7a5ad7ab

SHA512
20698fe5cd92f2ce9e71f8d79e0488c892551951d18cb8bb9af210c2ff44b9fe683f59ca52f672abeafac085386c640ddb54f978664e314aff6368f8e468ccca

Download Submit
C:\Windows\{FC04DF75-B70F-4349-BB4D-8527F1446938}.exe

Filesize
372KB

MD5
6911081714ca4053adc962909842572c

SHA1
daf2aadceace86d72ab4dcbe5908daaa3a907c77

SHA256
53a8a139020a18164d4cac5fbf9f9be70d43e7dce22145c4fc89772f5a28e94a

SHA512
4becf8961324a02aa12d6f4b3ebe43a53bbfd64d8de545560e74efc3db3543370a11919901e25a76af1e0a494089c1068743688744a899604d62501bc854ba6f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads