ef06f2bd5901bc299a92c99d45f7029d84214b8885a816d502085bcb9fac528e

Analysis

max time kernel
156s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
Size

380KB
MD5

81e223ac0a3a37ca500c6a921ce4dfdb
SHA1

59de425381df3c9149120c021823fb3738a99594
SHA256

ef06f2bd5901bc299a92c99d45f7029d84214b8885a816d502085bcb9fac528e
SHA512

0aca55c373546eff488f8ed50a4f782365d66c2231455813df1bd01c70598afd4ab4d6d5b75eb2fc057e69301b43a6747f88249df59c793b010d80d6c9b6e2c0
SSDEEP

3072:mEGh0o/lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGNl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022775-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002313e-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023145-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002313e-15.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023145-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00050000000217fa-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006df-43.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE397682-FF51-4fa1-8C00-885531B79498}	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}\stubpath = "C:\\Windows\\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe"	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}\stubpath = "C:\\Windows\\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe"	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}\stubpath = "C:\\Windows\\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe"	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}	{AE397682-FF51-4fa1-8C00-885531B79498}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}\stubpath = "C:\\Windows\\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe"	{AE397682-FF51-4fa1-8C00-885531B79498}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8704363F-31AA-4b4b-BA46-EAC77C779C79}	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA925E15-A046-48ed-9878-2DB3D38C0042}\stubpath = "C:\\Windows\\{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe"	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6C007EC-D49D-4746-8345-973C7EAAF916}	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE397682-FF51-4fa1-8C00-885531B79498}\stubpath = "C:\\Windows\\{AE397682-FF51-4fa1-8C00-885531B79498}.exe"	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8704363F-31AA-4b4b-BA46-EAC77C779C79}\stubpath = "C:\\Windows\\{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe"	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA925E15-A046-48ed-9878-2DB3D38C0042}	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}\stubpath = "C:\\Windows\\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe"	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}\stubpath = "C:\\Windows\\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe"	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}\stubpath = "C:\\Windows\\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe"	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6C007EC-D49D-4746-8345-973C7EAAF916}\stubpath = "C:\\Windows\\{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe"	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe

Executes dropped EXE 11 IoCs

pid	Process
4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe
2248	{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
File created	C:\Windows\{AE397682-FF51-4fa1-8C00-885531B79498}.exe	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
File created	C:\Windows\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe	{AE397682-FF51-4fa1-8C00-885531B79498}.exe
File created	C:\Windows\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
File created	C:\Windows\{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
File created	C:\Windows\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
File created	C:\Windows\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
File created	C:\Windows\{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
File created	C:\Windows\{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
File created	C:\Windows\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
File created	C:\Windows\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
Token: SeIncBasePriorityPrivilege	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
Token: SeIncBasePriorityPrivilege	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
Token: SeIncBasePriorityPrivilege	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
Token: SeIncBasePriorityPrivilege	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
Token: SeIncBasePriorityPrivilege	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
Token: SeIncBasePriorityPrivilege	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
Token: SeIncBasePriorityPrivilege	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
Token: SeIncBasePriorityPrivilege	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
Token: SeIncBasePriorityPrivilege	1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4596	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	89
PID 4708 wrote to memory of 4596	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	89
PID 4708 wrote to memory of 4596	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	89
PID 4708 wrote to memory of 4700	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	90
PID 4708 wrote to memory of 4700	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	90
PID 4708 wrote to memory of 4700	4708	2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe	90
PID 4596 wrote to memory of 416	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	99
PID 4596 wrote to memory of 416	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	99
PID 4596 wrote to memory of 416	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	99
PID 4596 wrote to memory of 4520	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	100
PID 4596 wrote to memory of 4520	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	100
PID 4596 wrote to memory of 4520	4596	{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe	100
PID 416 wrote to memory of 1224	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	101
PID 416 wrote to memory of 1224	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	101
PID 416 wrote to memory of 1224	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	101
PID 416 wrote to memory of 932	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	102
PID 416 wrote to memory of 932	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	102
PID 416 wrote to memory of 932	416	{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe	102
PID 1224 wrote to memory of 3192	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	103
PID 1224 wrote to memory of 3192	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	103
PID 1224 wrote to memory of 3192	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	103
PID 1224 wrote to memory of 3360	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	104
PID 1224 wrote to memory of 3360	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	104
PID 1224 wrote to memory of 3360	1224	{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe	104
PID 3192 wrote to memory of 4604	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	105
PID 3192 wrote to memory of 4604	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	105
PID 3192 wrote to memory of 4604	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	105
PID 3192 wrote to memory of 3856	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	106
PID 3192 wrote to memory of 3856	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	106
PID 3192 wrote to memory of 3856	3192	{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe	106
PID 4604 wrote to memory of 3008	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	107
PID 4604 wrote to memory of 3008	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	107
PID 4604 wrote to memory of 3008	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	107
PID 4604 wrote to memory of 4476	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	108
PID 4604 wrote to memory of 4476	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	108
PID 4604 wrote to memory of 4476	4604	{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe	108
PID 3008 wrote to memory of 4956	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	109
PID 3008 wrote to memory of 4956	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	109
PID 3008 wrote to memory of 4956	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	109
PID 3008 wrote to memory of 3984	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	110
PID 3008 wrote to memory of 3984	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	110
PID 3008 wrote to memory of 3984	3008	{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe	110
PID 4956 wrote to memory of 4924	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	111
PID 4956 wrote to memory of 4924	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	111
PID 4956 wrote to memory of 4924	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	111
PID 4956 wrote to memory of 1772	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	112
PID 4956 wrote to memory of 1772	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	112
PID 4956 wrote to memory of 1772	4956	{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe	112
PID 4924 wrote to memory of 3432	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	113
PID 4924 wrote to memory of 3432	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	113
PID 4924 wrote to memory of 3432	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	113
PID 4924 wrote to memory of 4464	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	114
PID 4924 wrote to memory of 4464	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	114
PID 4924 wrote to memory of 4464	4924	{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe	114
PID 3432 wrote to memory of 1228	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	116
PID 3432 wrote to memory of 1228	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	116
PID 3432 wrote to memory of 1228	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	116
PID 3432 wrote to memory of 224	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	115
PID 3432 wrote to memory of 224	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	115
PID 3432 wrote to memory of 224	3432	{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe	115
PID 1228 wrote to memory of 2248	1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe	117
PID 1228 wrote to memory of 2248	1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe	117
PID 1228 wrote to memory of 2248	1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe	117
PID 1228 wrote to memory of 5056	1228	{AE397682-FF51-4fa1-8C00-885531B79498}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_81e223ac0a3a37ca500c6a921ce4dfdb_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
  C:\Windows\{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
    C:\Windows\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
      C:\Windows\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1224
    - - C:\Windows\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
        
        C:\Windows\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3192
      - C:\Windows\{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
        
        C:\Windows\{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
        
        C:\Windows\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
        
        C:\Windows\{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
        
        C:\Windows\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
        
        C:\Windows\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{78AFB~1.EXE > nul
        11⤵
        
        PID:224
        
        C:\Windows\{AE397682-FF51-4fa1-8C00-885531B79498}.exe
        
        C:\Windows\{AE397682-FF51-4fa1-8C00-885531B79498}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe
        
        C:\Windows\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe
        12⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE397~1.EXE > nul
        12⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FA3FF~1.EXE > nul
        10⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C6C00~1.EXE > nul
        9⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F538~1.EXE > nul
        8⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA925~1.EXE > nul
        7⤵
        
        PID:4476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A89AD~1.EXE > nul
        6⤵
        
        PID:3856
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AB811~1.EXE > nul
        5⤵
        
        PID:3360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{10DA5~1.EXE > nul
      4⤵
      PID:932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{87043~1.EXE > nul
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{10DA505E-ECB3-408f-83BD-CE0F9D04A309}.exe

Filesize
380KB

MD5
458f6f1a8b251d133d1c20e3b46dc74f

SHA1
802f700ad4d3935d66dfc7b5ed88a98259eece2a

SHA256
eecfea05bfa68bd09ef163c38a4b926b3f165d4da778ed55411dd30f21f29979

SHA512
d85df950a0761aece114c9380141c236079cdadd1f0e1f108d41b75bbc7acc0570e95b322edd8a65cd25ef6abd8807d11b15ebea4143664c53effff19bd6317a

Download Submit
C:\Windows\{2B9D9C1B-B03C-40a2-ACDA-6FA645ED304B}.exe

Filesize
380KB

MD5
1626276a450756446f482ef8f15df414

SHA1
fc16293c636b43ca2d4667ace4814087d53c8acc

SHA256
af634282dbc3d029fe643aee388346c62f3e01e1c75e7b58f7afa2af1726a55e

SHA512
03f539a7374b1fc5373158400a12d305504a453a3efc9b7bf84264a85b2c7a5537d3f5028620dc49ccec1c0e0e8b5b49fc3d5ea22ad3555fd3e78d20b609b515

Download Submit
C:\Windows\{78AFB52D-55E1-4253-A97B-52B38DDD0D3A}.exe

Filesize
380KB

MD5
e0d0f07399dcd843268dc14b8b23162c

SHA1
be1f1eab111a7d9319766b3c6ad1d598997120b5

SHA256
aa23f67b4a016e924886060868bf69ec6e80553e56b5824753a86b107acaabc2

SHA512
b7531f9fcd4b1120bbc30ecac1a5788ee4e8a2923ee08be3a42211989a3615c0337a1cd6621b958e3a30f69411ce4e2da9b51aca1d76ccc90aced76323035931

Download Submit
C:\Windows\{8704363F-31AA-4b4b-BA46-EAC77C779C79}.exe

Filesize
380KB

MD5
fd1cf8672dc107936b1f6a630edb99d8

SHA1
e94beea64979713f46bb2efeaddaf7eaf1dfa76c

SHA256
4c2aa5ced32f67214123e32f996c8b6675338127ea148ef33674adb61f33fcb6

SHA512
edc5857679036601c7219fd6e6bc392a61f7a5b97cfa33718264c16bed9bad54b2cafa034f59e1c0ffd275f477e1b14f796e9a2b0adfd4782d5e8965e08bde1a

Download Submit
C:\Windows\{9F5380B7-77C9-4826-ABFA-CCCED0D4CD2D}.exe

Filesize
380KB

MD5
63e65a7bf30dded42467e44138c4f48c

SHA1
1d4b9e7af0fd49b23c7fd7d7c922bcd320539c54

SHA256
0951da96f922c165b5bf308a481b8200ea8ba579d69ee70662c89afd66503789

SHA512
37f220b97733c31fc1a4a4e212afab4066006963f5f432488ee9f37be92b543778da183eabd41e68e4c34130c20738075279652fd8b15017f4694d953ed186ff

Download Submit
C:\Windows\{A89AD98E-D1A6-4dd7-A17A-113E7A160C1D}.exe

Filesize
380KB

MD5
da772e48c688ed42d959beaa94ab8b14

SHA1
477bd246606cee91f20cb8c3811c78a85ed4a6db

SHA256
d89b5a3b455435f39a1c44eac4f735c23257b078430b31a04381ad42dcd19d74

SHA512
d813054478131a727526b6d50143adf2cea0216a93f67edb9efa118136cba38bdb5f7cfb99c081ae5737957dba5b4b8658039af0b297cc127a673a00bfa04c76

Download Submit
C:\Windows\{AB8119B6-69D1-491f-BF3F-D288FB3E53F7}.exe

Filesize
380KB

MD5
1e4a838523608a69c25d487a725059b4

SHA1
7dea82e456cb5eede3c938bf5137538e4b9f1db7

SHA256
0a5f6313f8598f429d8af7eb7996d3887f028965452f5c330f9fcc06ffeebb80

SHA512
2541de2173e3d1f7a5d59c564b0ab27ce243e618937bb650cf2d238374fec8c616a1668836059fef09df0758ac76d1ddfd93f835bf63040fe66a01bc992c67b9

Download Submit
C:\Windows\{AE397682-FF51-4fa1-8C00-885531B79498}.exe

Filesize
380KB

MD5
c34478738904f7226f748ceb89122b81

SHA1
ad6b86b3b01c06a6ca5899ea1f5c7fb1c42bfffb

SHA256
cb54b375b4dfd57ffecc482a91ef9d07c9f34b26dff81922c183f166020bc90a

SHA512
01ddcaaaf0cc37a066b68ec99838e3e77a419b409283bfaa295241dfff39c2a9be8cee76a7a0db7cb236e7304e239fee6620f2a99b16d5c9e85606aa50e29dbc

Download Submit
C:\Windows\{C6C007EC-D49D-4746-8345-973C7EAAF916}.exe

Filesize
380KB

MD5
917d9d4906b0680d999a77967eafc73e

SHA1
5bb18bb54fb29dad41d9cbbbb9fb153060d43176

SHA256
034de0662efffd068026c997050f3e44e3f0fd766268cfdf87747d13d3f8ac9f

SHA512
c5730e0f9429d133b96a0d158e4a739917696801370f16f22d27725dd4883b4f6fb71f028a078f56fdca31ec500650d0aed2f26381cda97e261e554c865674bb

Download Submit
C:\Windows\{DA925E15-A046-48ed-9878-2DB3D38C0042}.exe

Filesize
380KB

MD5
b7af5fe5880306a5a1ba3f4a8f2777c2

SHA1
c9aaca7943c7b94d2645d3c0373a248dab9ae9da

SHA256
4766ab54cc29166a4dc5608e44a1cb6129b121db06eb7dc1db923e31418c1bc9

SHA512
59bc0653d1397fcbc2c612889cd900588b818b08c0782d02b70ee7b9d000a2307d709a2b9ead8e2fa29b3a2b74b0299979e66ad07756e96169f92a0d2a08528a

Download Submit
C:\Windows\{FA3FF920-9655-42ae-BB40-7EB3B401DF25}.exe

Filesize
380KB

MD5
48f24714c7f63e220fb53ddd8d0e9413

SHA1
58c5fd613d410a0f891107ca45b81040d4ce6cdd

SHA256
eb008d8455bc5273eb62a70d94dd01bfdc96b0586a400b6d6e0cd3b003cb5f21

SHA512
6268e2b10f18a0247f583eda0ec497574d295272011f6483b887f0cc49c404376ab55979c9a813d15905f9644ca2b2bdbbc7f574048ab25e91ecf8973aa23293

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads