d1cb33ed6c3086536f0372e351f4c5d461721f6d1beaf14e88ed67ce1f4f9ab7

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Size

180KB
MD5

f004ba35380e50242981a5a106dd5bdd
SHA1

ac9608f34ec0725e06b96fb097c30fb62596cbff
SHA256

d1cb33ed6c3086536f0372e351f4c5d461721f6d1beaf14e88ed67ce1f4f9ab7
SHA512

af9f626fdcb8b748dc5bb766c6cee3889fe9e23e285bc96d0a9b1a1697286718a40ed0cb9ad78e81741da350c9f5df7b4157270ecc5714e6a43341444ddfe19c
SSDEEP

3072:jEGh0o9lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGHl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014439-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014439-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000016cea-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014439-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014439-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014439-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0038000000016d32-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000014439-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0039000000016d32-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000014439-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}\stubpath = "C:\\Windows\\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe"	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4C5EE33-0919-424b-9177-08176568619F}	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}\stubpath = "C:\\Windows\\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe"	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}	{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}\stubpath = "C:\\Windows\\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe"	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}\stubpath = "C:\\Windows\\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe"	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D4C5EE33-0919-424b-9177-08176568619F}\stubpath = "C:\\Windows\\{D4C5EE33-0919-424b-9177-08176568619F}.exe"	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}	{D4C5EE33-0919-424b-9177-08176568619F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}\stubpath = "C:\\Windows\\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe"	{D4C5EE33-0919-424b-9177-08176568619F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}\stubpath = "C:\\Windows\\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe"	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}\stubpath = "C:\\Windows\\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe"	{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA1242CD-915D-4842-92D7-C08906651B0D}	{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}\stubpath = "C:\\Windows\\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe"	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA1242CD-915D-4842-92D7-C08906651B0D}\stubpath = "C:\\Windows\\{CA1242CD-915D-4842-92D7-C08906651B0D}.exe"	{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA553517-6B9D-4abb-BF18-F442D84798F4}	{CA1242CD-915D-4842-92D7-C08906651B0D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA553517-6B9D-4abb-BF18-F442D84798F4}\stubpath = "C:\\Windows\\{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe"	{CA1242CD-915D-4842-92D7-C08906651B0D}.exe

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe
1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
788	{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
2056	{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
1924	{CA1242CD-915D-4842-92D7-C08906651B0D}.exe
1072	{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D4C5EE33-0919-424b-9177-08176568619F}.exe	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
File created	C:\Windows\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	{D4C5EE33-0919-424b-9177-08176568619F}.exe
File created	C:\Windows\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
File created	C:\Windows\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
File created	C:\Windows\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
File created	C:\Windows\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe	{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
File created	C:\Windows\{CA1242CD-915D-4842-92D7-C08906651B0D}.exe	{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
File created	C:\Windows\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
File created	C:\Windows\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
File created	C:\Windows\{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe	{CA1242CD-915D-4842-92D7-C08906651B0D}.exe
File created	C:\Windows\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
Token: SeIncBasePriorityPrivilege	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe
Token: SeIncBasePriorityPrivilege	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
Token: SeIncBasePriorityPrivilege	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
Token: SeIncBasePriorityPrivilege	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
Token: SeIncBasePriorityPrivilege	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
Token: SeIncBasePriorityPrivilege	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
Token: SeIncBasePriorityPrivilege	788	{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
Token: SeIncBasePriorityPrivilege	2056	{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
Token: SeIncBasePriorityPrivilege	1924	{CA1242CD-915D-4842-92D7-C08906651B0D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2292	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	28
PID 2336 wrote to memory of 2292	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	28
PID 2336 wrote to memory of 2292	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	28
PID 2336 wrote to memory of 2292	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	28
PID 2336 wrote to memory of 2724	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	29
PID 2336 wrote to memory of 2724	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	29
PID 2336 wrote to memory of 2724	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	29
PID 2336 wrote to memory of 2724	2336	2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe	29
PID 2292 wrote to memory of 2672	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	30
PID 2292 wrote to memory of 2672	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	30
PID 2292 wrote to memory of 2672	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	30
PID 2292 wrote to memory of 2672	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	30
PID 2292 wrote to memory of 2656	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	31
PID 2292 wrote to memory of 2656	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	31
PID 2292 wrote to memory of 2656	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	31
PID 2292 wrote to memory of 2656	2292	{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe	31
PID 2672 wrote to memory of 1860	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	32
PID 2672 wrote to memory of 1860	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	32
PID 2672 wrote to memory of 1860	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	32
PID 2672 wrote to memory of 1860	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	32
PID 2672 wrote to memory of 2440	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	33
PID 2672 wrote to memory of 2440	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	33
PID 2672 wrote to memory of 2440	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	33
PID 2672 wrote to memory of 2440	2672	{D4C5EE33-0919-424b-9177-08176568619F}.exe	33
PID 1860 wrote to memory of 1524	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	36
PID 1860 wrote to memory of 1524	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	36
PID 1860 wrote to memory of 1524	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	36
PID 1860 wrote to memory of 1524	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	36
PID 1860 wrote to memory of 852	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	37
PID 1860 wrote to memory of 852	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	37
PID 1860 wrote to memory of 852	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	37
PID 1860 wrote to memory of 852	1860	{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe	37
PID 1524 wrote to memory of 2636	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	38
PID 1524 wrote to memory of 2636	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	38
PID 1524 wrote to memory of 2636	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	38
PID 1524 wrote to memory of 2636	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	38
PID 1524 wrote to memory of 2420	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	39
PID 1524 wrote to memory of 2420	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	39
PID 1524 wrote to memory of 2420	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	39
PID 1524 wrote to memory of 2420	1524	{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe	39
PID 2636 wrote to memory of 2500	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	40
PID 2636 wrote to memory of 2500	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	40
PID 2636 wrote to memory of 2500	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	40
PID 2636 wrote to memory of 2500	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	40
PID 2636 wrote to memory of 1048	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	41
PID 2636 wrote to memory of 1048	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	41
PID 2636 wrote to memory of 1048	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	41
PID 2636 wrote to memory of 1048	2636	{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe	41
PID 2500 wrote to memory of 1704	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	42
PID 2500 wrote to memory of 1704	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	42
PID 2500 wrote to memory of 1704	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	42
PID 2500 wrote to memory of 1704	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	42
PID 2500 wrote to memory of 2508	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	43
PID 2500 wrote to memory of 2508	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	43
PID 2500 wrote to memory of 2508	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	43
PID 2500 wrote to memory of 2508	2500	{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe	43
PID 1704 wrote to memory of 788	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	44
PID 1704 wrote to memory of 788	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	44
PID 1704 wrote to memory of 788	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	44
PID 1704 wrote to memory of 788	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	44
PID 1704 wrote to memory of 1248	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	45
PID 1704 wrote to memory of 1248	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	45
PID 1704 wrote to memory of 1248	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	45
PID 1704 wrote to memory of 1248	1704	{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_f004ba35380e50242981a5a106dd5bdd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
  C:\Windows\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\{D4C5EE33-0919-424b-9177-08176568619F}.exe
    C:\Windows\{D4C5EE33-0919-424b-9177-08176568619F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
      C:\Windows\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Windows\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
        
        C:\Windows\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
        
        C:\Windows\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
        
        C:\Windows\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
        
        C:\Windows\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
        
        C:\Windows\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
        
        C:\Windows\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\{CA1242CD-915D-4842-92D7-C08906651B0D}.exe
        
        C:\Windows\{CA1242CD-915D-4842-92D7-C08906651B0D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe
        
        C:\Windows\{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe
        12⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA124~1.EXE > nul
        12⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7B83B~1.EXE > nul
        11⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F9CB~1.EXE > nul
        10⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F97F2~1.EXE > nul
        9⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95D83~1.EXE > nul
        8⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF7E4~1.EXE > nul
        7⤵
        
        PID:1048
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E85FF~1.EXE > nul
        6⤵
        
        PID:2420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62F7A~1.EXE > nul
        5⤵
        
        PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D4C5E~1.EXE > nul
      4⤵
      PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5E732~1.EXE > nul
    3⤵
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{4F9CBB20-95BA-4bb2-AA82-14522DE6A422}.exe

Filesize
180KB

MD5
01477c0d1d81f3cc453fd248f509e007

SHA1
113577dd64d33bae2e9343d27b5a55169b801dd5

SHA256
efc31c40b6d05218538aa47c6043a93ca7be9067dadc23114161fe9119c5828a

SHA512
6462efb71d67259cc4a48dec25596696793774e0c850775f5470c2e39d06fb20397660899c9566d9bd66e42b9171d5e9980c66f6a704419cfe6d4c077e6e373b

Download Submit
C:\Windows\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe

Filesize
180KB

MD5
ffaf9d46c4710424ad504f92086f5f8a

SHA1
e93f8457ba9ccfa0712f52e0740f577ee4d866a3

SHA256
cf6ce03a50294322dc2e21d83b93d43605e9367fbb4a04eece5f846c026c7f63

SHA512
b8e6adae75f651884e31c43f21a1da84744b981dd805ac4ef418b9d74c322effec27d7d30d8c273397bcb9bc04cbb2d9e86f491b748359742156fac9e84da55d

Download Submit
C:\Windows\{5E73269A-BFEB-4e6c-AA9C-3DCA9905CA04}.exe

Filesize
15KB

MD5
99e43ab3933497bf63804733791c9c39

SHA1
4ed016cf95e30a2a99bc4652332257acb8c021af

SHA256
b740e7a2ecbb37a217294071ef81fa55123e9deea7843ec230e62d180c7ca453

SHA512
e5b9d02fa42ad9d154fbdfd380ca66a39bf6205582da0a6abd8d17e9817cbb539aba8002020a2af44df4c0372822a195fcb201d604d78cbb9c9766e79177c3d4

Download Submit
C:\Windows\{62F7A483-14E0-4604-8CE8-2B3C6CC761EB}.exe

Filesize
180KB

MD5
7110e1f00035fade90abedb3455c670c

SHA1
b57db95f440278f5849af020e162ff859eceea86

SHA256
759adb0338caecc20b6b34a97dc85d0e981bf0c87fe868a6f38a8ccfc262a148

SHA512
824e564fc532e0972e693d522b57e1f8218c9250e4bfdd0418e88f4a3cb423dc094acc1f92397b1400d62f1b10eb55154993e1a02b3c86e1c881a6c74f672fc1

Download Submit
C:\Windows\{7B83BA4F-E616-48a1-9DDB-1A459B9AFAD6}.exe

Filesize
180KB

MD5
eae5d759048f6edfb8365c58b95eced8

SHA1
30c9dd28b092495cd1ed7f5b227abb78cfb469c2

SHA256
1c89bf5074a8b1940850eb4c75ac86fd48d680dc55573474cfb284248bed0cfa

SHA512
d921f641ce16577d430fec3c20d277563145933ca670b3ad32548cca8a440741fa1514ef4bf5fc2a32e4040640ee1024c9ed63ad8e6be8e9a05a4beca421c8e4

Download Submit
C:\Windows\{95D83D75-C258-4e67-B26F-26BA8E3C2EAA}.exe

Filesize
180KB

MD5
52fd5cb35349dc5ca5e17e2ce9278809

SHA1
f69040f034c6537d049aed74de1405a4ccf28cca

SHA256
4671c964f6437fb23c836fa911645bf9195c6727c96d2d3c77f3bab18662d767

SHA512
c556218e9b7c30c430524ed85755f18f1c9ac24287e39b66c0fa10664ebcdbdf585800d09626748f3731e027c6aefab45f99055e2beb046addc1d574c3e0a6dd

Download Submit
C:\Windows\{BA553517-6B9D-4abb-BF18-F442D84798F4}.exe

Filesize
180KB

MD5
b93ebee9da647b8fa11196e372a79108

SHA1
e472b06349b63d3e37a06faf4bf1ce72296e2f19

SHA256
44a1d9259eefa1be44d43eec8ee9e8771f334b2d33a15d351c0b4cd4a50d16c1

SHA512
2d19ceadc5d655b99b5f6c61265aa133dd62a95ba1c247ce204c8638ff802fa7ba66d655ebbfc2ca7714198ba0b5b4e7eeac664f200e1c80ad36d40c24ae695f

Download Submit
C:\Windows\{CA1242CD-915D-4842-92D7-C08906651B0D}.exe

Filesize
180KB

MD5
4ff62d273e664de6771df904e2101d6e

SHA1
6c3c081c7871b536ab8c587b43a029183405a398

SHA256
0dff2b31e22d4a6ab823985f3cf2aea2c87d46a0a89cb4cc4cd172a356dbfc37

SHA512
2adac58633b2b8efcfaacbfdb2d8d46cc83b7abe5916b7c9e4b7e8cb80d6bfe2e7f4f7d5fcf4c668a2054c1a6115d64812ae2c37efb524cf1b448860bc1de2aa

Download Submit
C:\Windows\{D4C5EE33-0919-424b-9177-08176568619F}.exe

Filesize
180KB

MD5
a1aabefeb196f50f784d26c0b31ec745

SHA1
c2495122df2cdb426c6eb1a51b6cba0fe4b6530d

SHA256
87b56def43c88f24593820773a23a7ff0046983b5eff13cd7dd781b20c6fabba

SHA512
73396491876047e2e42bdfa2cb0849dc2458044e2ffdf08f300195ef63d40508cfd5564cb7686bda10a2585bdefe32746368282b77edb7af494cffb303c77398

Download Submit
C:\Windows\{E85FF7FD-7754-4bbe-BF11-33C8259C91B0}.exe

Filesize
180KB

MD5
f09c87716d3b716853f328faff6d85af

SHA1
fa9f858c6290c65fe774be6b7c4dd8976dddb25a

SHA256
dce7e5a4c1fffbbee5e5da4e36784ce70c8ca15477a5f443277735ba5ca4479d

SHA512
5124a1a857efb18d9ba6c108991ad71343f759b2879c2161c9c75104690d69ff22e14c2ba2ac72ec6bbb4355278e121751353cb4bba410268dcffb7cfb102b18

Download Submit
C:\Windows\{F97F24AA-CE37-43dc-9ABC-8B96B6CC3721}.exe

Filesize
180KB

MD5
5b03c3cec4c69478f8388ec44d59dc3d

SHA1
fe340127e1ee5d3d454a1274375285c19b5d5e71

SHA256
5f93e3fffc45e56d60969d2f07f1b931649c3c6225915497603d87c05b419f69

SHA512
75946fdda08f038b8f4ff5918e6267c43495546dd827747de2bd6abb0dfd40d16e441c91ef4b3ba413a8512c65f2b7078ff985d5f0d4155a7310bb273df75dd7

Download Submit
C:\Windows\{FF7E4ABB-4DAF-49b9-AE3F-BF67E0EF8F01}.exe

Filesize
180KB

MD5
2a7539993f32344f72c2ac904892352a

SHA1
69d11cf31725fe10eb844c5d7e2b26c36f9468a4

SHA256
d831e0e3ea7cca1a16ad0a8f9bbed8777b9c829446523b6db31177717028e4c5

SHA512
2b660ae869b5c10ac260fca475d6179031d14e17cb85ec3991bc20ed3e7fd16fa2160f5b4941cd2caf2d82abd97d726a3e7290ec20832fbb31fea0cc3686d5b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads