7b19486c6c256918bd8991acbd894732af6b5cd474c8e9b67c1a1f1431601bbc

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
Size

197KB
MD5

bdd2bfca38ebe5a3d376dd501bef41f6
SHA1

ee0fb6e93430e9ceb90bc348faf40ded9c7a1bad
SHA256

7b19486c6c256918bd8991acbd894732af6b5cd474c8e9b67c1a1f1431601bbc
SHA512

a68c3e4910bcc6a8e91b1703ffbd76f2da9b197887fe29805caee7ff567a5f2fbdc0b5a0c02ebe10d9e35bb06b738a1a5c4cca5869e54f81ddc7f4fb15b504e0
SSDEEP

3072:jEGh0ovl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEG5lEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012267-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012301-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012267-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002900000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002a00000000b1f4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002b00000000b1f4-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002c00000000b1f4-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA286529-07D7-484a-BEB6-117E6B882F8B}	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5410D879-6A8F-419a-92FE-7A8576BBBD81}	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00834A7B-542E-4281-8F85-D1E206C17DA5}	{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA286529-07D7-484a-BEB6-117E6B882F8B}\stubpath = "C:\\Windows\\{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe"	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}\stubpath = "C:\\Windows\\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe"	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}\stubpath = "C:\\Windows\\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe"	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}\stubpath = "C:\\Windows\\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe"	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5410D879-6A8F-419a-92FE-7A8576BBBD81}\stubpath = "C:\\Windows\\{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe"	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{00834A7B-542E-4281-8F85-D1E206C17DA5}\stubpath = "C:\\Windows\\{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe"	{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}\stubpath = "C:\\Windows\\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe"	{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}\stubpath = "C:\\Windows\\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe"	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AE45823-6D78-4779-AC9F-F5283052CEB0}\stubpath = "C:\\Windows\\{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe"	{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}	{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}\stubpath = "C:\\Windows\\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe"	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E377B23-213F-43a8-A219-EACBED0F5931}	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E377B23-213F-43a8-A219-EACBED0F5931}\stubpath = "C:\\Windows\\{2E377B23-213F-43a8-A219-EACBED0F5931}.exe"	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5AE45823-6D78-4779-AC9F-F5283052CEB0}	{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe

Deletes itself 1 IoCs

pid	Process
2344	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
1492	{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
2988	{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
1744	{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
2020	{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe	{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
File created	C:\Windows\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe	{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
File created	C:\Windows\{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
File created	C:\Windows\{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
File created	C:\Windows\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
File created	C:\Windows\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
File created	C:\Windows\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
File created	C:\Windows\{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
File created	C:\Windows\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
File created	C:\Windows\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
File created	C:\Windows\{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe	{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
Token: SeIncBasePriorityPrivilege	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
Token: SeIncBasePriorityPrivilege	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
Token: SeIncBasePriorityPrivilege	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
Token: SeIncBasePriorityPrivilege	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
Token: SeIncBasePriorityPrivilege	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
Token: SeIncBasePriorityPrivilege	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
Token: SeIncBasePriorityPrivilege	1492	{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
Token: SeIncBasePriorityPrivilege	2988	{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
Token: SeIncBasePriorityPrivilege	1744	{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2684	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	28
PID 1984 wrote to memory of 2684	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	28
PID 1984 wrote to memory of 2684	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	28
PID 1984 wrote to memory of 2684	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	28
PID 1984 wrote to memory of 2344	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	29
PID 1984 wrote to memory of 2344	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	29
PID 1984 wrote to memory of 2344	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	29
PID 1984 wrote to memory of 2344	1984	2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe	29
PID 2684 wrote to memory of 3028	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	30
PID 2684 wrote to memory of 3028	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	30
PID 2684 wrote to memory of 3028	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	30
PID 2684 wrote to memory of 3028	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	30
PID 2684 wrote to memory of 2936	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	31
PID 2684 wrote to memory of 2936	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	31
PID 2684 wrote to memory of 2936	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	31
PID 2684 wrote to memory of 2936	2684	{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe	31
PID 3028 wrote to memory of 2016	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	32
PID 3028 wrote to memory of 2016	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	32
PID 3028 wrote to memory of 2016	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	32
PID 3028 wrote to memory of 2016	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	32
PID 3028 wrote to memory of 2648	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	33
PID 3028 wrote to memory of 2648	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	33
PID 3028 wrote to memory of 2648	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	33
PID 3028 wrote to memory of 2648	3028	{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe	33
PID 2016 wrote to memory of 1960	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	36
PID 2016 wrote to memory of 1960	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	36
PID 2016 wrote to memory of 1960	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	36
PID 2016 wrote to memory of 1960	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	36
PID 2016 wrote to memory of 2828	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	37
PID 2016 wrote to memory of 2828	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	37
PID 2016 wrote to memory of 2828	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	37
PID 2016 wrote to memory of 2828	2016	{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe	37
PID 1960 wrote to memory of 2956	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	38
PID 1960 wrote to memory of 2956	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	38
PID 1960 wrote to memory of 2956	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	38
PID 1960 wrote to memory of 2956	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	38
PID 1960 wrote to memory of 1608	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	39
PID 1960 wrote to memory of 1608	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	39
PID 1960 wrote to memory of 1608	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	39
PID 1960 wrote to memory of 1608	1960	{2E377B23-213F-43a8-A219-EACBED0F5931}.exe	39
PID 2956 wrote to memory of 1876	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	40
PID 2956 wrote to memory of 1876	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	40
PID 2956 wrote to memory of 1876	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	40
PID 2956 wrote to memory of 1876	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	40
PID 2956 wrote to memory of 2480	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	41
PID 2956 wrote to memory of 2480	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	41
PID 2956 wrote to memory of 2480	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	41
PID 2956 wrote to memory of 2480	2956	{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe	41
PID 1876 wrote to memory of 1640	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	42
PID 1876 wrote to memory of 1640	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	42
PID 1876 wrote to memory of 1640	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	42
PID 1876 wrote to memory of 1640	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	42
PID 1876 wrote to memory of 588	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	43
PID 1876 wrote to memory of 588	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	43
PID 1876 wrote to memory of 588	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	43
PID 1876 wrote to memory of 588	1876	{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe	43
PID 1640 wrote to memory of 1492	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	44
PID 1640 wrote to memory of 1492	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	44
PID 1640 wrote to memory of 1492	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	44
PID 1640 wrote to memory of 1492	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	44
PID 1640 wrote to memory of 2996	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	45
PID 1640 wrote to memory of 2996	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	45
PID 1640 wrote to memory of 2996	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	45
PID 1640 wrote to memory of 2996	1640	{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_bdd2bfca38ebe5a3d376dd501bef41f6_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
  C:\Windows\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
    C:\Windows\{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
      C:\Windows\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
        
        C:\Windows\{2E377B23-213F-43a8-A219-EACBED0F5931}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
        
        C:\Windows\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
        
        C:\Windows\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
        
        C:\Windows\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
        
        C:\Windows\{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
        
        C:\Windows\{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
        
        C:\Windows\{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe
        
        C:\Windows\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe
        12⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{00834~1.EXE > nul
        12⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5AE45~1.EXE > nul
        11⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5410D~1.EXE > nul
        10⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CAC9~1.EXE > nul
        9⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95BB6~1.EXE > nul
        8⤵
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EC469~1.EXE > nul
        7⤵
        
        PID:2480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E377~1.EXE > nul
        6⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E980B~1.EXE > nul
        5⤵
        
        PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DA286~1.EXE > nul
      4⤵
      PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E5661~1.EXE > nul
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{00834A7B-542E-4281-8F85-D1E206C17DA5}.exe

Filesize
197KB

MD5
6032a34a1c92cdb410a4ef82b3f23d24

SHA1
989e9bc459efcc6c831d61c083db92bc8feb9cc1

SHA256
e95bdc13745e2fc1704074b5d5ff76f94228eedc7bd839c27f8c2212b94d1ce5

SHA512
f932103f3e32cd06e1a4619e181d63062a3137c560af21ac265d116b78aa445f0bf60d56ca905c68c2f4dc891f4197569743ec763294e97f5b30465a28f1f8ed

Download Submit
C:\Windows\{2E377B23-213F-43a8-A219-EACBED0F5931}.exe

Filesize
197KB

MD5
85ddf1de49e29d4749866b1f30c36fa4

SHA1
1ccaf74a99d87b2be503015fd6fac0d0261d7f6e

SHA256
78bf4ffd502b6b805ced363fc7f5e1be14ad7986365e537538f6345b28d032c7

SHA512
5c893cb4d9314617a6cd2a75acb101ec0ca771f34ab4c1871b2834284b716263bb486f9ce79a69eb4d19f48ccab2586cdd3da9eafbd82afe395ff38b9d4b6466

Download Submit
C:\Windows\{5410D879-6A8F-419a-92FE-7A8576BBBD81}.exe

Filesize
197KB

MD5
dc2e65bdcae52d330f00610ad341f99e

SHA1
c3f28a1010d30e80f91b7d411f13fbb43a2b11c0

SHA256
49cccac830da0c29d44893be31e16d650762352c614df0fc246fbccae2434cf0

SHA512
f2f3c863584fb6348a46304d21ec282748d36e971c31c5f59eaa9705714ad74f739cae585d59442a7242fe24fe96c4249d48147817a5e7fcbec3d900381142f5

Download Submit
C:\Windows\{5AE45823-6D78-4779-AC9F-F5283052CEB0}.exe

Filesize
197KB

MD5
4248b4fff9fb97fc9137a10749e40965

SHA1
a2c2c17ffbdc367f9f027ad0a8ab1b7cbcd44a29

SHA256
15eff09983406e8e40528ee5f20653ce84234ecfdacff38f7db1aa7aa00e6bc2

SHA512
65101bd6dba2f044eecb2c66ef4bd9cd48d2a5661d0b2b4610ce3894abd68ec3a99a363247051aaf287afc1812a8718d02ea55fa68c8f63b0e045610736fc1b0

Download Submit
C:\Windows\{7CAC9922-CFE2-42e3-ABAE-DE5B958F96D9}.exe

Filesize
197KB

MD5
0152479f043019684789ee4ef88eddf4

SHA1
ca61100b52644210af15f71429a847a25e0f2c2d

SHA256
e474ceb6a7e4a0b40e8f6cfbb8e4702ef309f58ceb0237f41ec812704f90af43

SHA512
5c280f8e46b066a105abeaf616f44f209493087dedc4abb0efd3994710860da8a326cd3e96dfe929edfd8fdf59d87aaecbf8750dfa7cb3f21d02d6b1ed0933bd

Download Submit
C:\Windows\{95BB6EFF-F839-48e3-B7CA-0EFF033AE140}.exe

Filesize
197KB

MD5
bb0a4455658d055001fe10cbb7a773d4

SHA1
779949ceec0926aea63a55b918ae5019f267cdc9

SHA256
db0e172f4d11f380f841a669eeb2a416d448eb57ed81b41dfb77e8595bb51fbc

SHA512
db8f3c96a5d1ebe1b0e0142f516a3c4bf2f68745f4ba2924411fc9be54fea0ba93d26778b8ecce15731c4ce78433181835624c3553b85c87c5bb76c1d983a44b

Download Submit
C:\Windows\{DA286529-07D7-484a-BEB6-117E6B882F8B}.exe

Filesize
197KB

MD5
3095077686f3a505d77bcc712bfa8cd5

SHA1
793f0d72295bc62e7dd2e6bf6ebed449f66ef1e2

SHA256
0bd622a1022f4786c1cc4443ae063a693ee486bdf900be244244c8be41c6eb27

SHA512
014e0b8b95c94d84edc6f494d59d353290ff9c4dcc360e3adf495ccd367171c9d37382b27578a7062918097ffd11ab088cd0c2d00994a548a0155572918bb3de

Download Submit
C:\Windows\{E5661962-3F1E-4a0d-9406-0188E4FCBC6E}.exe

Filesize
197KB

MD5
311665b5579efc97d9c377dfb67c6b55

SHA1
c2f3637fa6b03fc47ae98e0e60ea8d669395c142

SHA256
b64241ca857e1eff3cc64984600ff6ac31e4b988a5671c3a6517653d82193523

SHA512
e46af5de90212a328b18cfe79c11c5119bf49609edc399058ebe62e244ae1d6daa4f09f0ea43fbbbe2177ed4230dfbc91efc380d5b16604b0ce57ff4903f79c7

Download Submit
C:\Windows\{E980B66B-03AB-4617-8C38-E0B35A9AFF57}.exe

Filesize
197KB

MD5
d72ca9c131fb1a478f391cb601fbc1a1

SHA1
662e9b9a76a3accc1eeff3126865b954844bbe87

SHA256
3d7f2dfe751d1bc955c08dd8d09abb7deac671261f610c43a66b37bb39f652b1

SHA512
5d79555b5b78bea0c51c55ebf49ee842ce36a627aac2a26505ad435f6ce393a65f9c29fdaea896ac45bd30854aee5e293df8473112378346df72bd5557740a03

Download Submit
C:\Windows\{EC46928F-0AD6-4845-9B69-9624D86DCFCC}.exe

Filesize
197KB

MD5
415fa602b8c75fbfa5e627bb991e0208

SHA1
e2de0500eb6467f2f4d58081a24ccfc064c2549a

SHA256
093a4ce0005264579a72c15c72a114f0f031b230bae1579cad0ddaa33ae92c6c

SHA512
0f1e016597fc08f4de5faf9b1a6d9bbb2458d05d1a3b4c362dc5b42ea91e0e23c3522ccbaaa9d21e5e48cf891100473949529f6826e7a365ea097014328b6630

Download Submit
C:\Windows\{F29D852B-DE35-48d4-A4DF-7958E9BFCEFA}.exe

Filesize
197KB

MD5
940e275e707313b1d7b88b4cb6d1709a

SHA1
2fb7001a0e171e471664b96d42ecf0204d1de3d8

SHA256
85b3aa83fe60a01ad10f3822f3a2ea47f8e5306fe266e3fed535a06695c73f4c

SHA512
4fa2c6e0cd6bd9d37ff9af06cc8d4432125d106891389f10c2446ba066dc588e4326cf67c17c6aaa37e0bf350f0695e80e0c780f730cb7308043c2509cd34b07

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads