1163dc9075723431154ddec8c25ca3b2b6560764a714208e9e687d798c4fca15

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
Size

408KB
MD5

ff635b4ac83f10132b3a9dfe98d9f983
SHA1

874be00839258faf4154537274a123fe5549bddb
SHA256

1163dc9075723431154ddec8c25ca3b2b6560764a714208e9e687d798c4fca15
SHA512

34a3ddd6e81c3af98472ad32e4d4a121f9a7c758e69ae02813bbae2589ec62130e501ce4640954670b7953ef37c63e2533c1c1fa07020d7d90bd59e19f9df7d1
SSDEEP

3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGNldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012238-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012683-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6f8-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012683-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000f6f8-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012683-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000000f6f8-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012683-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f8-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012683-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f8-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}\stubpath = "C:\\Windows\\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe"	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}\stubpath = "C:\\Windows\\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe"	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}\stubpath = "C:\\Windows\\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe"	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}\stubpath = "C:\\Windows\\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe"	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}	{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}\stubpath = "C:\\Windows\\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe"	{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}\stubpath = "C:\\Windows\\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe"	{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}\stubpath = "C:\\Windows\\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe"	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}\stubpath = "C:\\Windows\\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe"	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}\stubpath = "C:\\Windows\\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe"	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}	{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}	{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}\stubpath = "C:\\Windows\\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe"	{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}\stubpath = "C:\\Windows\\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe"	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe

Deletes itself 1 IoCs

pid	Process
2800	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
2880	{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
1616	{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
2176	{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
2968	{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
File created	C:\Windows\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
File created	C:\Windows\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
File created	C:\Windows\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe	{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
File created	C:\Windows\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
File created	C:\Windows\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
File created	C:\Windows\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
File created	C:\Windows\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
File created	C:\Windows\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe	{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
File created	C:\Windows\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe	{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
File created	C:\Windows\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
Token: SeIncBasePriorityPrivilege	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
Token: SeIncBasePriorityPrivilege	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
Token: SeIncBasePriorityPrivilege	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
Token: SeIncBasePriorityPrivilege	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
Token: SeIncBasePriorityPrivilege	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
Token: SeIncBasePriorityPrivilege	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
Token: SeIncBasePriorityPrivilege	2880	{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
Token: SeIncBasePriorityPrivilege	1616	{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
Token: SeIncBasePriorityPrivilege	2176	{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2808	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	28
PID 2676 wrote to memory of 2808	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	28
PID 2676 wrote to memory of 2808	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	28
PID 2676 wrote to memory of 2808	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	28
PID 2676 wrote to memory of 2800	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	29
PID 2676 wrote to memory of 2800	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	29
PID 2676 wrote to memory of 2800	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	29
PID 2676 wrote to memory of 2800	2676	2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe	29
PID 2808 wrote to memory of 2744	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	30
PID 2808 wrote to memory of 2744	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	30
PID 2808 wrote to memory of 2744	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	30
PID 2808 wrote to memory of 2744	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	30
PID 2808 wrote to memory of 2684	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	31
PID 2808 wrote to memory of 2684	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	31
PID 2808 wrote to memory of 2684	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	31
PID 2808 wrote to memory of 2684	2808	{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe	31
PID 2744 wrote to memory of 2316	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	35
PID 2744 wrote to memory of 2316	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	35
PID 2744 wrote to memory of 2316	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	35
PID 2744 wrote to memory of 2316	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	35
PID 2744 wrote to memory of 268	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	34
PID 2744 wrote to memory of 268	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	34
PID 2744 wrote to memory of 268	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	34
PID 2744 wrote to memory of 268	2744	{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe	34
PID 2316 wrote to memory of 772	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	37
PID 2316 wrote to memory of 772	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	37
PID 2316 wrote to memory of 772	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	37
PID 2316 wrote to memory of 772	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	37
PID 2316 wrote to memory of 1164	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	36
PID 2316 wrote to memory of 1164	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	36
PID 2316 wrote to memory of 1164	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	36
PID 2316 wrote to memory of 1164	2316	{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe	36
PID 772 wrote to memory of 3024	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	39
PID 772 wrote to memory of 3024	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	39
PID 772 wrote to memory of 3024	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	39
PID 772 wrote to memory of 3024	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	39
PID 772 wrote to memory of 2404	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	38
PID 772 wrote to memory of 2404	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	38
PID 772 wrote to memory of 2404	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	38
PID 772 wrote to memory of 2404	772	{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe	38
PID 3024 wrote to memory of 1124	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	40
PID 3024 wrote to memory of 1124	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	40
PID 3024 wrote to memory of 1124	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	40
PID 3024 wrote to memory of 1124	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	40
PID 3024 wrote to memory of 952	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	41
PID 3024 wrote to memory of 952	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	41
PID 3024 wrote to memory of 952	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	41
PID 3024 wrote to memory of 952	3024	{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe	41
PID 1124 wrote to memory of 1732	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	43
PID 1124 wrote to memory of 1732	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	43
PID 1124 wrote to memory of 1732	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	43
PID 1124 wrote to memory of 1732	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	43
PID 1124 wrote to memory of 1760	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	42
PID 1124 wrote to memory of 1760	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	42
PID 1124 wrote to memory of 1760	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	42
PID 1124 wrote to memory of 1760	1124	{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe	42
PID 1732 wrote to memory of 2880	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	44
PID 1732 wrote to memory of 2880	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	44
PID 1732 wrote to memory of 2880	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	44
PID 1732 wrote to memory of 2880	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	44
PID 1732 wrote to memory of 2872	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	45
PID 1732 wrote to memory of 2872	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	45
PID 1732 wrote to memory of 2872	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	45
PID 1732 wrote to memory of 2872	1732	{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_ff635b4ac83f10132b3a9dfe98d9f983_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
  C:\Windows\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
    C:\Windows\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3FB04~1.EXE > nul
      4⤵
      PID:268
  - - C:\Windows\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
      C:\Windows\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{700F5~1.EXE > nul
        5⤵
        
        PID:1164
    - - C:\Windows\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
        
        C:\Windows\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:772
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53DB4~1.EXE > nul
        6⤵
        
        PID:2404
      - C:\Windows\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
        
        C:\Windows\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
        
        C:\Windows\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED31E~1.EXE > nul
        8⤵
        
        PID:1760
        
        C:\Windows\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
        
        C:\Windows\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
        
        C:\Windows\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
        
        C:\Windows\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
        
        C:\Windows\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe
        
        C:\Windows\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe
        12⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75C3A~1.EXE > nul
        12⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E9A1~1.EXE > nul
        11⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9AA5~1.EXE > nul
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2972~1.EXE > nul
        9⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{597F3~1.EXE > nul
        7⤵
        
        PID:952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E7D30~1.EXE > nul
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{3FB0450E-8122-4f3c-A51E-1CADF3AD3AB4}.exe

Filesize
408KB

MD5
808b2e489ee091e825dc0dfc10d45fea

SHA1
a0f17f7d0f17a4888717e3c29e3fb5eb98dd8187

SHA256
216dec929a5755c7cb0da997e167f6098a4a6e84abaeddca8dbe13092359cf53

SHA512
64328637ee16083edaf4f26dd362dc76a1a9d6e6d712582d39568648cb6895fd2e2e3b8087e463cfdfcb5412b880099693bf4e4498a29c7ab268113fee035eee

Download Submit
C:\Windows\{53DB49F5-194B-46f7-8B5A-CA80C250F1B8}.exe

Filesize
408KB

MD5
6919506be18c1a27fa54f8d6542d3a05

SHA1
bf1fa0152c2c1916fd039f7204c506419b3e789c

SHA256
9e6d4068dca5b944d943701587238418b3b0a0e3a71fcbad0eb2fa1f930b7385

SHA512
2c43458974d922bdbfeec09540b2e784c2db60970f4d224050d86b68ab26995db7ab13698597e1735e344589daeb1bf482b72f21c5fe225c25578308aa233866

Download Submit
C:\Windows\{597F3D81-2747-455a-AB4B-85C33C3B6C5B}.exe

Filesize
408KB

MD5
31a4ec3d3b6fdd007aa9429def456f46

SHA1
67d74251bcbeea80d15fa196c8c3181ed41b4185

SHA256
c12ed2742344d88081ec1099efae87ef4b7b671e7163dc48c062a22146468f6a

SHA512
9651de4a4021249ebeb466a2b3d63dc5caa046ce2281f48a707ac699305644faab7ca3dee88d3ef084e3407018888df9da8b970fb9fbd5579f59b66e753e177e

Download Submit
C:\Windows\{700F5340-A8C5-4852-9EF1-2ADA96088C3F}.exe

Filesize
408KB

MD5
e462879a23e9a6785d23ffd33d5f0e02

SHA1
f9c8281301e2921c4df8b66fdd2f708f0c387723

SHA256
758063182c15880f4563d37511d26febfa09f3563e4388d5e275950e3a28a50d

SHA512
bb8682c8ebe47e1252a1792e469d905d17be8e0d5292bbd6f908bfce38b1888b02db4e721686f1522f9f647cba747f358e39e8a17d40fe8e3af8f02bc28de38f

Download Submit
C:\Windows\{75C3AC5B-FE65-4edf-9738-F090E2BC1A95}.exe

Filesize
408KB

MD5
1bdf25a6ab3aa0b0b8d15a9b3cbc437e

SHA1
21009540d2ec174923f4e2246b617eb7114c7220

SHA256
364e55c550eb7a6fc618a09c5ab1e1fe2e4d88ef91c9f6a20e468946453a8d11

SHA512
38076d7fa8dc7b7b7bef1e8331f7295fdea1e29011a7817756835fb933bb454ab09c2a9f56a350bc8b33f50d6a19f8543347b0569e971c80477ab4390bb87e67

Download Submit
C:\Windows\{7E9A190C-B0B4-4f37-A030-C54C0B45ED0A}.exe

Filesize
408KB

MD5
7d36d762689f7e89f6fe64ab7bebd761

SHA1
6396b02b5d7b0185ee6b5b2383284a8b3bb1664e

SHA256
62b8fcdd96d837ab4c371812d99d4399aa2eb89e0de6ec370cdf724ab21465ac

SHA512
a361a76c76fdc3a898aaf4a750ae8902a94251d913c9585426b75d10d159ff4e60f19c75be39f0be827b9cae0db4f161b355a985bfadcbfd17c92efb26ba9cd7

Download Submit
C:\Windows\{89B58D0B-62E8-4958-B6B5-8CB5F7F4A66A}.exe

Filesize
408KB

MD5
0851ceba2f10871eea3e00e73c3b7629

SHA1
f0afa50aac20e7774d36e52c1873e2dc7c511b32

SHA256
0c85e0d2defa95b8a41f50bedb1e7182ed8bb033b11350fe7759b9f81329a5d5

SHA512
74e2f0aff658ffb84d650b2b5da94625f24fa73504931269382b4d7db7e026a7f4493571ad9e302d71a9db2c3708131655b0a9ff1e2a80f8b90459b507f42706

Download Submit
C:\Windows\{C9AA5D7E-8BC9-4fdc-9545-38F7FCE5D6EA}.exe

Filesize
408KB

MD5
a376963d972854acb7f83823331d90fc

SHA1
e036fb2ad5ac018ced8f417a41c4c71e18d0a43a

SHA256
8cf024da72913fc4f10f0295d4f1909837b340de7907175345454ce4d0f56820

SHA512
80738fd5ab505bef4cab47aebd2e029c87700e448d06ffe10afbe7aac99ef62780722c176644d8093b50215a074aeee6988baed0f2c3d876ce5ed96718b180e4

Download Submit
C:\Windows\{E29721A0-5014-45cc-9FFB-FEEA2BDC9907}.exe

Filesize
408KB

MD5
749c9bfc7cce3e5fbce8ac8f451a43a2

SHA1
30b54372c33d212f5be9b43c0b9e43b2b57f972b

SHA256
2ddea71240454400298746bc3372276f0bf65656a40b7db0ceeac7915939ca59

SHA512
708416cf9a47309d0c79c1bff6ff98f76d430e628384ad8ca74af39adb9e7c11a368c7ece0a40ccaa3b6180727be20adaf7f7e7c134de536d929d2b76e602353

Download Submit
C:\Windows\{E7D30C94-FCA6-4007-A423-B5A7AAA23065}.exe

Filesize
408KB

MD5
13dbc37104b8fda2e3bca6ed8ef10df0

SHA1
3e8828cf154af92d18a4d88b5c55dcc681ea0f3a

SHA256
7580aca72d2821513613cf4b9e3ce5fd47b8ee4c62c145655547e48362de0cb2

SHA512
f069e975cdb20f9b525e80ad6766d87fdf9a3e1c870f80ef8b6f2f2d3a09577e513494efe45d40cc41d4e0cbf2ad10b29ffe1874d3160520ac6b87af58b078a8

Download Submit
C:\Windows\{ED31EF78-C6A2-4efa-9198-6D5EBE18BF11}.exe

Filesize
408KB

MD5
d88778e9b53c8f498dc382f17ff36367

SHA1
61b248d8cfdeb56f1d2483807cfc404c9aab1ca8

SHA256
80f9520d0953a1a7a0efd4e70bd1b2cd442f63b9e2e1f7a661398efb13faaaed

SHA512
27daca9453beb633c1300105df1de92c51fb93a489b32e8446d679d85b312737e8f780cbc33d050f240eb103dfd182c039e2920200caeadc41acd2ef4a991f46

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads