58a238b55b7077fea744225632b62e92ec3f69af49366d46ba54725c4313cd2f

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
Size

180KB
MD5

371d81a5c737f681b1d109f250d18c5d
SHA1

6517b318b1454caa33e3db2c4f21c7ae2159622e
SHA256

58a238b55b7077fea744225632b62e92ec3f69af49366d46ba54725c4313cd2f
SHA512

ff84132e04e7b82903135a676d6d89f18492d5a25ba2f4a12555bd2aac1e9aa6a0ce231190d09ed54b818175e5ab5bc000fe4e660e6b6fb7517668f9436f44b8
SSDEEP

3072:jEGh0o/klfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGWl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231f4-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00100000000231f9-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023200-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00150000000006c1-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002177b-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00160000000006c1-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002177b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00170000000006c1-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00180000000006c1-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2185001A-5541-4649-8651-BA35EB8612EF}	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D359615B-124B-4f67-B086-63A7484D7987}	{2185001A-5541-4649-8651-BA35EB8612EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A765841-84FE-4f34-A827-F523D06F1DD1}	{D359615B-124B-4f67-B086-63A7484D7987}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}\stubpath = "C:\\Windows\\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe"	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F90777F4-C3A1-492b-B09B-867C19CE8131}	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}	{68441D49-4745-41bc-9485-FF3844112F27}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7532852-3595-4349-BC0A-4062DB46EB2B}	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68441D49-4745-41bc-9485-FF3844112F27}\stubpath = "C:\\Windows\\{68441D49-4745-41bc-9485-FF3844112F27}.exe"	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}\stubpath = "C:\\Windows\\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe"	{68441D49-4745-41bc-9485-FF3844112F27}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2185001A-5541-4649-8651-BA35EB8612EF}\stubpath = "C:\\Windows\\{2185001A-5541-4649-8651-BA35EB8612EF}.exe"	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}\stubpath = "C:\\Windows\\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe"	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7532852-3595-4349-BC0A-4062DB46EB2B}\stubpath = "C:\\Windows\\{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe"	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68441D49-4745-41bc-9485-FF3844112F27}	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D359615B-124B-4f67-B086-63A7484D7987}\stubpath = "C:\\Windows\\{D359615B-124B-4f67-B086-63A7484D7987}.exe"	{2185001A-5541-4649-8651-BA35EB8612EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A765841-84FE-4f34-A827-F523D06F1DD1}\stubpath = "C:\\Windows\\{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe"	{D359615B-124B-4f67-B086-63A7484D7987}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}\stubpath = "C:\\Windows\\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe"	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F90777F4-C3A1-492b-B09B-867C19CE8131}\stubpath = "C:\\Windows\\{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe"	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}\stubpath = "C:\\Windows\\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe"	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe

Executes dropped EXE 11 IoCs

pid	Process
3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe
4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe
4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe
972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
3804	{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
File created	C:\Windows\{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
File created	C:\Windows\{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
File created	C:\Windows\{68441D49-4745-41bc-9485-FF3844112F27}.exe	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
File created	C:\Windows\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	{68441D49-4745-41bc-9485-FF3844112F27}.exe
File created	C:\Windows\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
File created	C:\Windows\{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	{D359615B-124B-4f67-B086-63A7484D7987}.exe
File created	C:\Windows\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
File created	C:\Windows\{2185001A-5541-4649-8651-BA35EB8612EF}.exe	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
File created	C:\Windows\{D359615B-124B-4f67-B086-63A7484D7987}.exe	{2185001A-5541-4649-8651-BA35EB8612EF}.exe
File created	C:\Windows\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
Token: SeIncBasePriorityPrivilege	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe
Token: SeIncBasePriorityPrivilege	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
Token: SeIncBasePriorityPrivilege	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
Token: SeIncBasePriorityPrivilege	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
Token: SeIncBasePriorityPrivilege	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe
Token: SeIncBasePriorityPrivilege	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe
Token: SeIncBasePriorityPrivilege	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
Token: SeIncBasePriorityPrivilege	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
Token: SeIncBasePriorityPrivilege	2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3188	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	91
PID 4268 wrote to memory of 3188	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	91
PID 4268 wrote to memory of 3188	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	91
PID 4268 wrote to memory of 3012	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	92
PID 4268 wrote to memory of 3012	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	92
PID 4268 wrote to memory of 3012	4268	2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe	92
PID 3188 wrote to memory of 2240	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	94
PID 3188 wrote to memory of 2240	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	94
PID 3188 wrote to memory of 2240	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	94
PID 3188 wrote to memory of 2092	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	93
PID 3188 wrote to memory of 2092	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	93
PID 3188 wrote to memory of 2092	3188	{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe	93
PID 2240 wrote to memory of 4160	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	97
PID 2240 wrote to memory of 4160	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	97
PID 2240 wrote to memory of 4160	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	97
PID 2240 wrote to memory of 4592	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	96
PID 2240 wrote to memory of 4592	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	96
PID 2240 wrote to memory of 4592	2240	{68441D49-4745-41bc-9485-FF3844112F27}.exe	96
PID 4160 wrote to memory of 2792	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	99
PID 4160 wrote to memory of 2792	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	99
PID 4160 wrote to memory of 2792	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	99
PID 4160 wrote to memory of 4772	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	98
PID 4160 wrote to memory of 4772	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	98
PID 4160 wrote to memory of 4772	4160	{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe	98
PID 2792 wrote to memory of 404	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	101
PID 2792 wrote to memory of 404	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	101
PID 2792 wrote to memory of 404	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	101
PID 2792 wrote to memory of 1096	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	100
PID 2792 wrote to memory of 1096	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	100
PID 2792 wrote to memory of 1096	2792	{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe	100
PID 404 wrote to memory of 876	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	102
PID 404 wrote to memory of 876	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	102
PID 404 wrote to memory of 876	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	102
PID 404 wrote to memory of 4580	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	103
PID 404 wrote to memory of 4580	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	103
PID 404 wrote to memory of 4580	404	{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe	103
PID 876 wrote to memory of 4800	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	104
PID 876 wrote to memory of 4800	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	104
PID 876 wrote to memory of 4800	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	104
PID 876 wrote to memory of 1900	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	105
PID 876 wrote to memory of 1900	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	105
PID 876 wrote to memory of 1900	876	{2185001A-5541-4649-8651-BA35EB8612EF}.exe	105
PID 4800 wrote to memory of 972	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	106
PID 4800 wrote to memory of 972	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	106
PID 4800 wrote to memory of 972	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	106
PID 4800 wrote to memory of 4132	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	107
PID 4800 wrote to memory of 4132	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	107
PID 4800 wrote to memory of 4132	4800	{D359615B-124B-4f67-B086-63A7484D7987}.exe	107
PID 972 wrote to memory of 1652	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	108
PID 972 wrote to memory of 1652	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	108
PID 972 wrote to memory of 1652	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	108
PID 972 wrote to memory of 1584	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	109
PID 972 wrote to memory of 1584	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	109
PID 972 wrote to memory of 1584	972	{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe	109
PID 1652 wrote to memory of 2468	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	110
PID 1652 wrote to memory of 2468	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	110
PID 1652 wrote to memory of 2468	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	110
PID 1652 wrote to memory of 3620	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	111
PID 1652 wrote to memory of 3620	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	111
PID 1652 wrote to memory of 3620	1652	{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe	111
PID 2468 wrote to memory of 3804	2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe	112
PID 2468 wrote to memory of 3804	2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe	112
PID 2468 wrote to memory of 3804	2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe	112
PID 2468 wrote to memory of 4788	2468	{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_371d81a5c737f681b1d109f250d18c5d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
  C:\Windows\{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F9077~1.EXE > nul
    3⤵
    PID:2092
- - C:\Windows\{68441D49-4745-41bc-9485-FF3844112F27}.exe
    C:\Windows\{68441D49-4745-41bc-9485-FF3844112F27}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{68441~1.EXE > nul
      4⤵
      PID:4592
  - - C:\Windows\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
      C:\Windows\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{828E7~1.EXE > nul
        5⤵
        
        PID:4772
    - - C:\Windows\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
        
        C:\Windows\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B4AE~1.EXE > nul
        6⤵
        
        PID:1096
      - C:\Windows\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
        
        C:\Windows\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\{2185001A-5541-4649-8651-BA35EB8612EF}.exe
        
        C:\Windows\{2185001A-5541-4649-8651-BA35EB8612EF}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\{D359615B-124B-4f67-B086-63A7484D7987}.exe
        
        C:\Windows\{D359615B-124B-4f67-B086-63A7484D7987}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
        
        C:\Windows\{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
        
        C:\Windows\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
        
        C:\Windows\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe
        
        C:\Windows\{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe
        12⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8B72~1.EXE > nul
        12⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9FCA0~1.EXE > nul
        11⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A765~1.EXE > nul
        10⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3596~1.EXE > nul
        9⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21850~1.EXE > nul
        8⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA6A5~1.EXE > nul
        7⤵
        
        PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2185001A-5541-4649-8651-BA35EB8612EF}.exe

Filesize
180KB

MD5
fc006ffd3be04e8bb348291a2bf442b3

SHA1
b63120a70043faa2791e776b60ded2f05d04fa79

SHA256
b3633c51d2e006659d572cb76ac2b3c6d9217155c406318d7a41e4da3985d5d6

SHA512
b944b53d261d5c6f02211ef380ac918cc9b91df95d377c13e92973f327f064483e585fda563ae90cfa905b462fe18b92084325be267430a5821e3322d1f99144

Download Submit
C:\Windows\{3B4AE3B5-E6FE-4900-BDBE-B6AE9818E187}.exe

Filesize
180KB

MD5
a45a12d4ff4ebeafb437ae2d36f1ed8e

SHA1
8adfd3ddfeb19265c612cf5bdaa983978cfc0ec7

SHA256
ce319545c6c5193cfc73a61f3b16a85c68881ac9842549409177b0a12c071a28

SHA512
b4fe30b2a5c547df4367560fea901b2106afc71a4d1efd884e9395247befa4eac3807adfa086ae303de635f8dad3e99a93900db8748d28c787a9204ab73dc871

Download Submit
C:\Windows\{68441D49-4745-41bc-9485-FF3844112F27}.exe

Filesize
180KB

MD5
95f5743b13984b0cbfa406876809fa78

SHA1
8098f3b274b0116a448e29c7244ce2b429b1ab4b

SHA256
e996c0241b62a71fc9ebdeb637dd7e49831751d8c68ea323604e0c1f0785beda

SHA512
ac648960146e65918bea51b7b9876c7969f80c86c2bb56e64b0c1a5200ff051003d670fc594c6ae385f9507cac9627b4bc1e2b601cfd26f16dfb88b8ee056392

Download Submit
C:\Windows\{828E75AD-771A-4315-8F3E-98DEF2C5CC2D}.exe

Filesize
180KB

MD5
bd917bbc4480b020f3777158e704a9d9

SHA1
7f73beda727c66fccabcb07c33c4179d0ae50696

SHA256
3a13241e3b8c2582762ec1f4b2cd18656c657d60a18b229094138667268f0c40

SHA512
a29d1175847e471ff1e6b16680748ba8c59ea53a0f58d400b33fd705731eab3f64cbd965dc71e89c579f950a4d6b253162410b98ea3cb8a63defa556e38fb976

Download Submit
C:\Windows\{9A765841-84FE-4f34-A827-F523D06F1DD1}.exe

Filesize
180KB

MD5
c9e9f123dd202547eda5e0b55addd455

SHA1
71f1a9af20c93b2910f9f6c0fb9db85845508751

SHA256
d6ca3216283892ebab7547bea0dc145975f19d95fe158370ab6b6f4088fe10ab

SHA512
7b50f2e926c65582ef8c43f1a9b7ef41e696544c5aee09dbd5fc0f34f8da100c73122b9047e998be297663f6219be5769ea9d1298be0dd612fcea60815f07e1a

Download Submit
C:\Windows\{9FCA09F3-6C3B-44a3-83F9-07FE7375B2DB}.exe

Filesize
180KB

MD5
f90eeffa2dcecb90cbc24a7d3c2f126e

SHA1
685a126d4d9783cbb196a04a3b7c8295c98ace2f

SHA256
39f5642d0e1dcd9ee22196192fd289fa07749f46c3e873e67d08651d2744258e

SHA512
dcbff34af33c1023c18b327ae2a09bbfec649ebf94362688171dccb6914f1393b12f2f164bec5b197a2767c54ff6edb3d0426990f9ed8996622a785f3c0611b1

Download Submit
C:\Windows\{A7532852-3595-4349-BC0A-4062DB46EB2B}.exe

Filesize
180KB

MD5
a873587922d18f749c83727968d1e75b

SHA1
de5562ed2c6923d13576d3df3a386800e17892d1

SHA256
a8cff37a01db23be0eae2f5d58399282e89879536c5800a2bb7b5aab4372b18a

SHA512
0e9d1abf1befe8a6fb58044e092e9cee445ba5447f5b7cbd74ca24e5c1dfe96efdf0ff9d7e0a5bf2d5fd369e448973513309246cfecedf8ddad828146d5e843b

Download Submit
C:\Windows\{B8B72E78-647F-40af-BCC6-B86E3D8F862D}.exe

Filesize
180KB

MD5
046530bbaa7d5651ad8ebc05c0887c2a

SHA1
2899d3dc156b78e92353f5cc96e7dcb2df57f43e

SHA256
7cf3d89b536aa8d484cb6db40358b20410b7d6f48e6285b05e8e74cdcfccf66f

SHA512
421670555039379a0e62f9fc35ca5cfd45b09cbdb43a6e5c70697429f8ded255ad7a1f2d308637eeba7e2968765f9bedbd79057c1eb256e7f5dd23f0b5aa4a74

Download Submit
C:\Windows\{D359615B-124B-4f67-B086-63A7484D7987}.exe

Filesize
180KB

MD5
a83f0d4fde64e85ecede269bf6947182

SHA1
be1c0132561713a06de04645b949af8950f7f0a2

SHA256
6b508618648e6bb3ddcc313afe34dfd9da87fbae9d6196214888f28b7a617f51

SHA512
63f88efccdc14eb8ba98eeff458b97a54a243134a7514ca9cdf3b5b5a87b55240a458c0c48515857f4a6a1d96686b549184ac6a04b4ebc70400752905fa876d5

Download Submit
C:\Windows\{DA6A50E7-85E6-4fee-88B4-7210F473E39A}.exe

Filesize
180KB

MD5
2afb7971ec72186e9b86db720a225e9c

SHA1
e8f9acf5535a75ef0b3c1e88aac939b5ca036ada

SHA256
3296973a64f25bbf18426e843bea80a528a86274bf7440f7fc16705442ad50cd

SHA512
e257b8c93b8ea58afc3ff46f5c8f6362e33acd4aad1f39928f87928d44beeeced3c0aad3aa326398e6246f5d7c3d04683da6d59a58a303fadd0ed7bb0def5777

Download Submit
C:\Windows\{F90777F4-C3A1-492b-B09B-867C19CE8131}.exe

Filesize
180KB

MD5
f1387c06e08177176b674ee58740104d

SHA1
0d3cef3ca1c032578d0b65ea7ecb12e48157ef21

SHA256
d8c38468ec11ccbf56fc162604d3aac96aa8202f1b1a24083d40d06f424fd66f

SHA512
52e22721771d5e6c7d3c3c0c7ab2e048e7f2dc22c3ad5c171af096a9fd496ef4fa06432a0f7e69e93056b31f650daf6ce2f50560442fa7761be58f6be627c0ba

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads