576b5f70cebe56e6cdb1780185193999a4643c32b9f0c401790b1d9b3389d836

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
Size

197KB
MD5

cb665dd1294543a9d393349cd8627262
SHA1

3cb34170ce4585381cf725c5f4faf16c11abd5a2
SHA256

576b5f70cebe56e6cdb1780185193999a4643c32b9f0c401790b1d9b3389d836
SHA512

282b4a531114fab0ebc7eff29893c02620431d186cbd80e3f9516c2a7506fba9794d95ee3870f9377740d34ee2228b3117bb6937a5fad61f8bfb33f9946ea3a7
SSDEEP

3072:jEGh0o2l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGslEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x001000000002322a-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023205-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023231-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023205-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001300000001d887-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000021558-21.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001400000001d887-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000707-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000709-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000707-37.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000000709-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000707-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7C34473-EAA2-4724-B898-86EEF3D5371A}	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18E5B929-1327-49e7-A6A5-7B00D8706720}	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}\stubpath = "C:\\Windows\\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe"	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1242877-86F9-450a-A7D6-E75F21798D29}	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1242877-86F9-450a-A7D6-E75F21798D29}\stubpath = "C:\\Windows\\{E1242877-86F9-450a-A7D6-E75F21798D29}.exe"	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{300E3654-6906-48f1-8A59-73D15DC86E4E}\stubpath = "C:\\Windows\\{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe"	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F92C03E1-D942-469a-A662-7CC96CA659FA}\stubpath = "C:\\Windows\\{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe"	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{414F4F47-769F-4120-8519-30D60F6FD6D0}\stubpath = "C:\\Windows\\{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe"	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88A624B7-C5E4-44c9-9792-558F17A35E0D}	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88A624B7-C5E4-44c9-9792-558F17A35E0D}\stubpath = "C:\\Windows\\{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe"	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F92C03E1-D942-469a-A662-7CC96CA659FA}	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EE3E439-4C2E-412f-9021-50E96691F063}	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EE3E439-4C2E-412f-9021-50E96691F063}\stubpath = "C:\\Windows\\{8EE3E439-4C2E-412f-9021-50E96691F063}.exe"	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{414F4F47-769F-4120-8519-30D60F6FD6D0}	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}\stubpath = "C:\\Windows\\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe"	{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80D39051-F0DA-40fe-B207-E1855EB71A35}	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80D39051-F0DA-40fe-B207-E1855EB71A35}\stubpath = "C:\\Windows\\{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe"	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18E5B929-1327-49e7-A6A5-7B00D8706720}\stubpath = "C:\\Windows\\{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe"	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}	{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7C34473-EAA2-4724-B898-86EEF3D5371A}\stubpath = "C:\\Windows\\{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe"	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}\stubpath = "C:\\Windows\\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe"	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{300E3654-6906-48f1-8A59-73D15DC86E4E}	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe

Executes dropped EXE 12 IoCs

pid	Process
2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
2484	{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
3488	{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
File created	C:\Windows\{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
File created	C:\Windows\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
File created	C:\Windows\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
File created	C:\Windows\{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
File created	C:\Windows\{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
File created	C:\Windows\{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
File created	C:\Windows\{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
File created	C:\Windows\{8EE3E439-4C2E-412f-9021-50E96691F063}.exe	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
File created	C:\Windows\{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
File created	C:\Windows\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe	{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
File created	C:\Windows\{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
Token: SeIncBasePriorityPrivilege	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
Token: SeIncBasePriorityPrivilege	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
Token: SeIncBasePriorityPrivilege	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
Token: SeIncBasePriorityPrivilege	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
Token: SeIncBasePriorityPrivilege	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
Token: SeIncBasePriorityPrivilege	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
Token: SeIncBasePriorityPrivilege	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
Token: SeIncBasePriorityPrivilege	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
Token: SeIncBasePriorityPrivilege	640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
Token: SeIncBasePriorityPrivilege	2484	{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2196	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	92
PID 4776 wrote to memory of 2196	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	92
PID 4776 wrote to memory of 2196	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	92
PID 4776 wrote to memory of 2252	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	93
PID 4776 wrote to memory of 2252	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	93
PID 4776 wrote to memory of 2252	4776	2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe	93
PID 2196 wrote to memory of 3956	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	94
PID 2196 wrote to memory of 3956	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	94
PID 2196 wrote to memory of 3956	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	94
PID 2196 wrote to memory of 2816	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	95
PID 2196 wrote to memory of 2816	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	95
PID 2196 wrote to memory of 2816	2196	{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe	95
PID 3956 wrote to memory of 1372	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	98
PID 3956 wrote to memory of 1372	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	98
PID 3956 wrote to memory of 1372	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	98
PID 3956 wrote to memory of 1732	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	97
PID 3956 wrote to memory of 1732	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	97
PID 3956 wrote to memory of 1732	3956	{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe	97
PID 1372 wrote to memory of 4076	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	99
PID 1372 wrote to memory of 4076	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	99
PID 1372 wrote to memory of 4076	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	99
PID 1372 wrote to memory of 3968	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	100
PID 1372 wrote to memory of 3968	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	100
PID 1372 wrote to memory of 3968	1372	{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe	100
PID 4076 wrote to memory of 2276	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	101
PID 4076 wrote to memory of 2276	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	101
PID 4076 wrote to memory of 2276	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	101
PID 4076 wrote to memory of 3972	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	102
PID 4076 wrote to memory of 3972	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	102
PID 4076 wrote to memory of 3972	4076	{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe	102
PID 2276 wrote to memory of 3236	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	103
PID 2276 wrote to memory of 3236	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	103
PID 2276 wrote to memory of 3236	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	103
PID 2276 wrote to memory of 832	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	104
PID 2276 wrote to memory of 832	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	104
PID 2276 wrote to memory of 832	2276	{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe	104
PID 3236 wrote to memory of 768	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	105
PID 3236 wrote to memory of 768	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	105
PID 3236 wrote to memory of 768	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	105
PID 3236 wrote to memory of 3712	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	106
PID 3236 wrote to memory of 3712	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	106
PID 3236 wrote to memory of 3712	3236	{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe	106
PID 768 wrote to memory of 3656	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	107
PID 768 wrote to memory of 3656	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	107
PID 768 wrote to memory of 3656	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	107
PID 768 wrote to memory of 4744	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	108
PID 768 wrote to memory of 4744	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	108
PID 768 wrote to memory of 4744	768	{E1242877-86F9-450a-A7D6-E75F21798D29}.exe	108
PID 3656 wrote to memory of 4412	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	109
PID 3656 wrote to memory of 4412	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	109
PID 3656 wrote to memory of 4412	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	109
PID 3656 wrote to memory of 976	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	110
PID 3656 wrote to memory of 976	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	110
PID 3656 wrote to memory of 976	3656	{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe	110
PID 4412 wrote to memory of 640	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	111
PID 4412 wrote to memory of 640	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	111
PID 4412 wrote to memory of 640	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	111
PID 4412 wrote to memory of 1788	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	112
PID 4412 wrote to memory of 1788	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	112
PID 4412 wrote to memory of 1788	4412	{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe	112
PID 640 wrote to memory of 2484	640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe	114
PID 640 wrote to memory of 2484	640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe	114
PID 640 wrote to memory of 2484	640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe	114
PID 640 wrote to memory of 4172	640	{8EE3E439-4C2E-412f-9021-50E96691F063}.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_cb665dd1294543a9d393349cd8627262_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
  C:\Windows\{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
    C:\Windows\{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{80D39~1.EXE > nul
      4⤵
      PID:1732
  - - C:\Windows\{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
      C:\Windows\{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Windows\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
        
        C:\Windows\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4076
      - C:\Windows\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
        
        C:\Windows\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
        
        C:\Windows\{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
        
        C:\Windows\{E1242877-86F9-450a-A7D6-E75F21798D29}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
        
        C:\Windows\{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
        
        C:\Windows\{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
        
        C:\Windows\{8EE3E439-4C2E-412f-9021-50E96691F063}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8EE3E~1.EXE > nul
        12⤵
        
        PID:4172
        
        C:\Windows\{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
        
        C:\Windows\{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe
        
        C:\Windows\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe
        13⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{414F4~1.EXE > nul
        13⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F92C0~1.EXE > nul
        11⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{300E3~1.EXE > nul
        10⤵
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1242~1.EXE > nul
        9⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88A62~1.EXE > nul
        8⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0FB35~1.EXE > nul
        7⤵
        
        PID:832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7532A~1.EXE > nul
        6⤵
        
        PID:3972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18E5B~1.EXE > nul
        5⤵
        
        PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D7C34~1.EXE > nul
    3⤵
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0FB35E47-3BD0-4bdc-929D-073CFEFD3B2A}.exe

Filesize
197KB

MD5
d3f905d51004d461cbdf51df65eb7ae7

SHA1
793c61d24a8819675f50cfdfb7364c813b68bddd

SHA256
03608966d5c77d696411248058a8356c2370a66c6eed62c5520467bdbcb89877

SHA512
aedbe04b3eba0f507f5fb51a1bd670e34ac73f50cdf55c32f3c5b600d98cf95629a5da093e1e705d04af6ee429fa9d8672ae517b3476f91b45e8c5cd2875724f

Download Submit
C:\Windows\{18E5B929-1327-49e7-A6A5-7B00D8706720}.exe

Filesize
197KB

MD5
682e434bfb3b98460d7782563145a163

SHA1
2ad167dd03e5d73f9e4ba05240f5716401d6ca5c

SHA256
7475b06ee66ef0202a96c3f271a4a5e5f308fd6821b7f81eb0d335b529bf6955

SHA512
db10db96773a160411463913e928e8fb4a43df3d5f6e7a0d35059387f4b4e94b2c9fe7921d84b491fe8b271b04024018ed9fb8f55c5b7cf787ba6090bf8e64a6

Download Submit
C:\Windows\{300E3654-6906-48f1-8A59-73D15DC86E4E}.exe

Filesize
197KB

MD5
c022b45da2fc990733780c9401005c9b

SHA1
b68abdff60fce940f0dd1a1977f65295268d76af

SHA256
45b72d1aca358a1d5a68d7a458ca7606e27df6790b7f9858cd187f49f3c380ac

SHA512
6b852de3be3987d61b511ed41473d6fa32227b01d45e0c026e3ebda7b0e751f07f94eb7cad437054edfae1446cb88d35b784c860d78f4d2d259dec0a3894cd2d

Download Submit
C:\Windows\{414F4F47-769F-4120-8519-30D60F6FD6D0}.exe

Filesize
197KB

MD5
00a444c07122753e353741aa01c11fd1

SHA1
efe752534309c560f2f59921fa3a45c5453a8b53

SHA256
24af03f0df4c3dbe9ee4204c6ce1168725d3b32bcec2cd14e48634dc3a11d78b

SHA512
bed9e4fcdc353eab61eca36fcbd280916f55f00d5c798c9df71474c42fcb065136ece5f49bf0e78d3d5d7a4bb43eca580b2364ef14ab5f8bf3a41610b21230c5

Download Submit
C:\Windows\{4B81CFA4-6A06-4459-A22C-ED34B69116E5}.exe

Filesize
197KB

MD5
b5286d781792ecd5ba11821eed9429d1

SHA1
b0923ec9a22a2eefb42cae680f0e2020aba47bd1

SHA256
497cba2b8542a4c2d59e15b82c7e35b0bf771211ba36c91fe04de145b24b303c

SHA512
02f75f9f9fa15d2fc1acaa1bc6153a76e85bdf246a8ce243088676766506bad0fde44a0d25cdb87198fedae7da362ec9f891e4c094fda7ca92eacb5a4130620c

Download Submit
C:\Windows\{7532ADA6-C7CD-4e10-A377-4339BD4F8FB1}.exe

Filesize
197KB

MD5
160a9b3f2448d1ffcfdf383fa5f94635

SHA1
26cebdcbfd59f7e2414bb824c1b3595271c9647a

SHA256
6de773e42e7b73f8ca77dcd790e0533db319b22f461feed0074279919f82e03f

SHA512
9dc792998d92b4038f850e6016a3855b9d2108deeecd8bc0199d642b602afcd7d0c20d6dd67481f0644c68e9af5d9625c7a945e7913dea0d74ca1885f91ff83c

Download Submit
C:\Windows\{80D39051-F0DA-40fe-B207-E1855EB71A35}.exe

Filesize
197KB

MD5
c182506dbfbaa489ebbf042f093f307e

SHA1
5a542a1b275d5685a2f0a52c69da87e48762e877

SHA256
2bc8c5ba62277e2e354a0aac2e252f3ee25c036d8c32c334edb0941593a71579

SHA512
fab017b780363cc76398d7c46dadd528f26bf24e9287c35813a35caa70cf8207a9ae06189cf7d5edd7b6f3504188e09795bc5465b63912f188230f76f36d9826

Download Submit
C:\Windows\{88A624B7-C5E4-44c9-9792-558F17A35E0D}.exe

Filesize
197KB

MD5
208b159d7bd8c911cf2f3d8a4fde90b9

SHA1
8398a8aa23955ac500396ebceeb8e7768b1836fd

SHA256
2f2e3d298a4c0d6497939f2777fcd4f0d679f111243e78c00eb20550f0b226ce

SHA512
259d5ed7285337a2d286802a90ae54a908d10e1239a763b211c463d925ba8526b9ac8530aeef3b9f5e05a879aa76f03353fbe2f4965e67c59df12f4b9ffbb957

Download Submit
C:\Windows\{8EE3E439-4C2E-412f-9021-50E96691F063}.exe

Filesize
197KB

MD5
f9d488996d369ffc84152a0600afa746

SHA1
6243a558e1e519e77ff47c83174ae28504d46888

SHA256
2e3a1fe0259355185ac747da1538492334cf49f52dee8c21a2356e3d27139c2d

SHA512
296070562d97273620a09d24e670e3648d2ca1614d476baed1b320bc2061a654dace85a5ecd76c03ca00e712925b9c02b2e7e63664f280adecfa198267a78e6d

Download Submit
C:\Windows\{D7C34473-EAA2-4724-B898-86EEF3D5371A}.exe

Filesize
197KB

MD5
b191eeffc158ec770c927f8b06b8ebca

SHA1
aea6029605f0c573a7ab0be4df8da6e6d8314cef

SHA256
6b42bb741b75edd17ee870160496bfe30fd40b69ab77e247f2b419b701a9b9f5

SHA512
1b1aa7f60c6e70110c6142aa8b8dc89c4f2f470e8aa30b0cc6e68692fe0f5c6d4d6f0983b26220bccb60e76bbdc078afbc8899398ad6190923e300af984cae09

Download Submit
C:\Windows\{E1242877-86F9-450a-A7D6-E75F21798D29}.exe

Filesize
197KB

MD5
d133339d96e401c67faa73b244fab311

SHA1
f19a5d227c62cab4bda6357cc77450e0a8e1def1

SHA256
2d915880ee4195fd624ede90f135c637ffa2e5094761ed4517031ddcf05d511c

SHA512
6458dde18b90a9819563743ff5be57f53760f4723119ab9674a0c2abed731a90b8c7ee0ef39cb3b4c6e1ac7bf0f32ad39202eb68262d1799a1b09c8377c72087

Download Submit
C:\Windows\{F92C03E1-D942-469a-A662-7CC96CA659FA}.exe

Filesize
197KB

MD5
e5e94bbbb4728c6d1fe3e9de13dcbc83

SHA1
bef9bd099d36ba7144d32de77809e5e9b27f219a

SHA256
7211c42129e4c4093e2fddd083e010d3aa5ccf0fea8bbdc50be65802a432f430

SHA512
ec68aaf1e2a4200d1321e2091211bd9c78b50f1f3a63450538098ac89ec2dd955605fabf31fe0229c24562da66d89d37cea446de6dd39a5d1c9e33f20ba4cb79

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads