09f0f380852de773bac766a53f08c787664bb17c49958c90dce991eb104d2347

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe
Size

408KB
MD5

9afcce7aeaa503c77dbf092ae0584cc3
SHA1

542701d64d921d6dec0cdd3443acb94f76f3bd3d
SHA256

09f0f380852de773bac766a53f08c787664bb17c49958c90dce991eb104d2347
SHA512

edc99e45262accac276a15775562e95d6b8aa7a8d56937c749b288e203a6c73ecfbe1cdd3b18c614c4496dc5797add37a44c676c4aaa0f330c7cb7d7e29d06a4
SSDEEP

3072:CEGh0oZl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG/ldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001225c-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000012281-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001225c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-48.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98C50F52-FC4E-4606-8205-7A505B9361C4}\stubpath = "C:\\Windows\\{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe"	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}\stubpath = "C:\\Windows\\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe"	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}\stubpath = "C:\\Windows\\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe"	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}\stubpath = "C:\\Windows\\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe"	{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}	{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}\stubpath = "C:\\Windows\\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe"	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBB5FF94-19CA-424c-8D6D-794C4006499A}\stubpath = "C:\\Windows\\{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe"	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}\stubpath = "C:\\Windows\\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe"	{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}\stubpath = "C:\\Windows\\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe"	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{64051ECF-3D00-4f33-A0DD-687B175C0731}\stubpath = "C:\\Windows\\{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe"	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}	{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}	{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98C50F52-FC4E-4606-8205-7A505B9361C4}	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{64051ECF-3D00-4f33-A0DD-687B175C0731}	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBB5FF94-19CA-424c-8D6D-794C4006499A}	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}\stubpath = "C:\\Windows\\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe"	{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}\stubpath = "C:\\Windows\\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe"	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe

Deletes itself 1 IoCs

pid	Process
2672	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
1480	{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
1500	{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
528	{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe
2252	{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe
File created	C:\Windows\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe	{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
File created	C:\Windows\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
File created	C:\Windows\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
File created	C:\Windows\{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
File created	C:\Windows\{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
File created	C:\Windows\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
File created	C:\Windows\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
File created	C:\Windows\{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
File created	C:\Windows\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe	{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
File created	C:\Windows\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe	{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
Token: SeIncBasePriorityPrivilege	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
Token: SeIncBasePriorityPrivilege	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
Token: SeIncBasePriorityPrivilege	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
Token: SeIncBasePriorityPrivilege	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
Token: SeIncBasePriorityPrivilege	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
Token: SeIncBasePriorityPrivilege	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
Token: SeIncBasePriorityPrivilege	1480	{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
Token: SeIncBasePriorityPrivilege	1500	{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
Token: SeIncBasePriorityPrivilege	528	{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2340	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	28
PID 3016 wrote to memory of 2340	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	28
PID 3016 wrote to memory of 2340	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	28
PID 3016 wrote to memory of 2340	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	28
PID 3016 wrote to memory of 2672	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	29
PID 3016 wrote to memory of 2672	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	29
PID 3016 wrote to memory of 2672	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	29
PID 3016 wrote to memory of 2672	3016	2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe	29
PID 2340 wrote to memory of 2908	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	31
PID 2340 wrote to memory of 2908	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	31
PID 2340 wrote to memory of 2908	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	31
PID 2340 wrote to memory of 2908	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	31
PID 2340 wrote to memory of 2700	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	30
PID 2340 wrote to memory of 2700	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	30
PID 2340 wrote to memory of 2700	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	30
PID 2340 wrote to memory of 2700	2340	{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe	30
PID 2908 wrote to memory of 848	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	33
PID 2908 wrote to memory of 848	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	33
PID 2908 wrote to memory of 848	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	33
PID 2908 wrote to memory of 848	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	33
PID 2908 wrote to memory of 2496	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	32
PID 2908 wrote to memory of 2496	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	32
PID 2908 wrote to memory of 2496	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	32
PID 2908 wrote to memory of 2496	2908	{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe	32
PID 848 wrote to memory of 1952	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	37
PID 848 wrote to memory of 1952	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	37
PID 848 wrote to memory of 1952	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	37
PID 848 wrote to memory of 1952	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	37
PID 848 wrote to memory of 2628	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	36
PID 848 wrote to memory of 2628	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	36
PID 848 wrote to memory of 2628	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	36
PID 848 wrote to memory of 2628	848	{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe	36
PID 1952 wrote to memory of 2604	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	39
PID 1952 wrote to memory of 2604	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	39
PID 1952 wrote to memory of 2604	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	39
PID 1952 wrote to memory of 2604	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	39
PID 1952 wrote to memory of 1984	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	38
PID 1952 wrote to memory of 1984	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	38
PID 1952 wrote to memory of 1984	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	38
PID 1952 wrote to memory of 1984	1952	{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe	38
PID 2604 wrote to memory of 1788	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	40
PID 2604 wrote to memory of 1788	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	40
PID 2604 wrote to memory of 1788	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	40
PID 2604 wrote to memory of 1788	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	40
PID 2604 wrote to memory of 2480	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	41
PID 2604 wrote to memory of 2480	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	41
PID 2604 wrote to memory of 2480	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	41
PID 2604 wrote to memory of 2480	2604	{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe	41
PID 1788 wrote to memory of 1964	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	42
PID 1788 wrote to memory of 1964	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	42
PID 1788 wrote to memory of 1964	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	42
PID 1788 wrote to memory of 1964	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	42
PID 1788 wrote to memory of 680	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	43
PID 1788 wrote to memory of 680	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	43
PID 1788 wrote to memory of 680	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	43
PID 1788 wrote to memory of 680	1788	{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe	43
PID 1964 wrote to memory of 1480	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	44
PID 1964 wrote to memory of 1480	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	44
PID 1964 wrote to memory of 1480	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	44
PID 1964 wrote to memory of 1480	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	44
PID 1964 wrote to memory of 1620	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	45
PID 1964 wrote to memory of 1620	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	45
PID 1964 wrote to memory of 1620	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	45
PID 1964 wrote to memory of 1620	1964	{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_9afcce7aeaa503c77dbf092ae0584cc3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
  C:\Windows\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7A8E1~1.EXE > nul
    3⤵
    PID:2700
- - C:\Windows\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
    C:\Windows\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{EB5B8~1.EXE > nul
      4⤵
      PID:2496
  - - C:\Windows\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
      C:\Windows\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BFC21~1.EXE > nul
        5⤵
        
        PID:2628
    - - C:\Windows\{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
        
        C:\Windows\{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1952
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{64051~1.EXE > nul
        6⤵
        
        PID:1984
      - C:\Windows\{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
        
        C:\Windows\{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
        
        C:\Windows\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
        
        C:\Windows\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
        
        C:\Windows\{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBB5F~1.EXE > nul
        10⤵
        
        PID:2108
        
        C:\Windows\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
        
        C:\Windows\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{46BC4~1.EXE > nul
        11⤵
        
        PID:2392
        
        C:\Windows\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe
        
        C:\Windows\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FCE0~1.EXE > nul
        12⤵
        
        PID:2364
        
        C:\Windows\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe
        
        C:\Windows\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe
        12⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2008~1.EXE > nul
        9⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9D47~1.EXE > nul
        8⤵
        
        PID:680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98C50~1.EXE > nul
        7⤵
        
        PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1FCE0C6B-9453-4c5f-9412-E45F4F935161}.exe

Filesize
408KB

MD5
8fd073d4295335a17480e4deab9a4190

SHA1
1a6e4e0522c203a471df2dfeb92c9b016af78c17

SHA256
22ae7d47defc78fa1069925c9093e7db293fdee2b467ffc5efc26c43b0847ba7

SHA512
3786239dc81e83fec4b0faa9aaaa87c481993b867d01ba36071fe24c1210019ade34f4f66c9a2840e781632d3cd6fb2a26226a0aaffb99d549249c73ba7925a7

Download Submit
C:\Windows\{46BC4638-2C9A-4dd9-B291-5D5E0DD7D8AD}.exe

Filesize
408KB

MD5
fe37fda0270f017effef304c54e3287e

SHA1
40262802ab3642af114a2e6f2bcb3c42c3eeb261

SHA256
47d1751b9929311b08f2bfd04a915e5ca16073b7dcec1da5fb484f0d72295fe9

SHA512
0b4b279d10cf6dff02271e750619474f70a0af5576d520a072b36c8371718e0ced42eada800ab4023ed4f7b7936d007ce157302a3c0ca3015031c96e92495065

Download Submit
C:\Windows\{52B65B55-C1FF-4dec-96A5-2CF197DE43C8}.exe

Filesize
408KB

MD5
188e7ad007c16bc70f2a9c4583ebb63e

SHA1
8b3612f3d0d99b202d7c4bc96a2920c3ced89bee

SHA256
9459c0c3657284d1eb991de26b624aa2a7550110cd8ed44be3fb5aa4d8d1f86b

SHA512
c89501265e12bc5cca9b6bf483c93b04ba3ae151105fda25b83a2589aeeade7ec145f213eaa4948b8102e2a099a3e681009a728ecbbf8795602e042ce6f0d772

Download Submit
C:\Windows\{64051ECF-3D00-4f33-A0DD-687B175C0731}.exe

Filesize
408KB

MD5
776bf614415027ee8c5154d97c25a35f

SHA1
ce2d696e59c782b93d7d9e4299ac27ce62c7970f

SHA256
df81cd0216cc5856d3417eec6f63064d9ee8cb6cd599d95024ced8ba4d491e4f

SHA512
53163f50517b392bdbff245f08ffd40360854c6c05783aae66d9a24959e66f110306bb0b94846a0e5e708998e1a40636c45741c2f6969d50cd9104303d1c6d8e

Download Submit
C:\Windows\{7A8E15DA-E32C-488f-9B3D-727BB2316F1C}.exe

Filesize
408KB

MD5
6e015b75369ef2500b0fc1ad5d875762

SHA1
e88376b8e401c6386c11a10f47dac57ccf44b8cb

SHA256
90836b796cc6833f18440805e50d166dc7185eb1d431439bfd92102617653730

SHA512
f689d8fea6bb810f183fe1086dc7a676c2b6bb591f5fef6190110e19b859921e2439c141337b63c76164a4b84d249ab66eab14ec2dccd456eb1f133e8b937ce0

Download Submit
C:\Windows\{98C50F52-FC4E-4606-8205-7A505B9361C4}.exe

Filesize
408KB

MD5
7a1efb0136b8b6b23a326339febc3a3a

SHA1
d8ad551d3d7b34fad436bacc41c98e7a4265bfe4

SHA256
21fcf73a289b4881dbe92d6c001e2bb09d875d0b14e1210170b5ea5faf5c81ef

SHA512
c1d28e406f160799a63a9613bc0da08b7a66470660b56dcae88d824d2db783fbbd4ad2259d125cfccc26ba46740da8d30a340c94876918662dbb90cc74299498

Download Submit
C:\Windows\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe

Filesize
408KB

MD5
38c96621df1063d08d9ca608af8355a6

SHA1
894de9f62964e85340afc96f52ef9cffa1c0fca4

SHA256
0f0447836ab299431ea437448278f7e44d3b13fc8c6a020695b260126932e59e

SHA512
9c19f62544a48e736b1038b95467917ec63626727f553da943b61c16fbd291bf57bdc5804043c3974e6c3b418c0c94c91a4ecbdc96a3b1f43d11bd24241c6036

Download Submit
C:\Windows\{B9D4754F-E8B4-443d-9228-3A7D4023DFAC}.exe

Filesize
78KB

MD5
1bee25d9d246c2b46325c89cbe1ab7d2

SHA1
2be5afb6d2d58756511c4238235c860699927ac2

SHA256
949d7e480c6fab0aa54cdf07559fd86e30f27ced1642a4d3ef9cd24134b00c44

SHA512
c54bb1dd7c4eb74368d7a7ebad0d3959255f8914ec7a4c77be03da572be3ad323faa1c2ee91f223c5860024d2c1746a44197dc42c87be30e16c199b126f65258

Download Submit
C:\Windows\{BFC2113B-D3C3-4234-B077-C9D7AEAE48B5}.exe

Filesize
408KB

MD5
40b7a92f408fa0b10b0c26c8508ac997

SHA1
51b41b7d97e02167b5af6525728eb1c1563c3cf1

SHA256
9428eb1a5b4692669cd5e40984e21356a85ea11200014ed829ffba7a1dd95dba

SHA512
a048d3492427c6a95fc0992c3fa745f0235e912657f9820ddb1a55224b58eb57450f602eadb8316d1f932c5729ebe09ad9772858820189540a87c8ee3fcfe3b4

Download Submit
C:\Windows\{DBB5FF94-19CA-424c-8D6D-794C4006499A}.exe

Filesize
408KB

MD5
6815f3224fd14ee0296aae0342408450

SHA1
b42a1a01153bdc844e9907043533f3edec4c0cdc

SHA256
d36c06b51fd8ad320a4bf7c0bfeae39028447dc3863e1e94b502bc55f9bfcda4

SHA512
543fe30cc9e488d3634a90bfa91d5ff124bba64a4e4a7f58414470ea2b58eee3ed2e4c7ee3e4069a5a1e20fbbf939e641de4f94c711984b27eab2ce8c9196112

Download Submit
C:\Windows\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe

Filesize
73KB

MD5
509708a894ad8a3af5da5b20688ffbb6

SHA1
348a9c5f68f6568d532925ee143fd7282d2139c7

SHA256
fcf0cc13c3dfcbd5020db2b03c82863c1538993e29d1229b462e836c11c9311e

SHA512
5d2267dfc2e1eaeacab8b988800237b4ce44eb317924d10e3e18cda59aab772587f3f3afae2ef967c94f92eca8fb9f2f8438e52a3101e4cde7fbe8a049b1dede

Download Submit
C:\Windows\{E2008D9F-897D-4cf0-AF60-9BD854B43D1C}.exe

Filesize
408KB

MD5
f127e3e7f7b015bb25c366e563f3ed4b

SHA1
4e1d696f62063badedc9a09babbc253d39035789

SHA256
2edcaebe911d8c1624fc1ce3042a9dfa040c4300436a48278c39c68135fcf6f5

SHA512
ee1fe327e32457835d353e4328900d447159b27d6c92582d4fabc4fa8314ff7fcec9b5f804ae16f5e8ac57ccb85df52da5690c8e8d0458ee293aa978b6cdf091

Download Submit
C:\Windows\{EB5B8CC0-F7EF-44ca-9699-8E02FB154897}.exe

Filesize
408KB

MD5
61da219e0b78b875d8e8b8656b87b7e6

SHA1
b4266bcd25b4a8ac01fde57bc27a17778576f8fa

SHA256
653bd67b28f0bd95b03a813d53c586595c1b357e21fe6816a11cd4f8029395c6

SHA512
cbac516cdf44c67f3052141c49b7fd2de6ee5bd64eaa06d80029aaa987a7a02a2d5c4b84bc32ce64eee87a4c6efd3a0966c78c89d1ecef599ac8b721a3d13d98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads