f9341249d04a4d712c8a6d7c248ffc28e8f2f779c41f416e8a5c9876cb4aa46a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
Size

180KB
MD5

519a9ee44e1923b099f49d5da225601d
SHA1

a16736e2704c5fcbae6df7ed58778d0794e597f6
SHA256

f9341249d04a4d712c8a6d7c248ffc28e8f2f779c41f416e8a5c9876cb4aa46a
SHA512

38342e8c2a166b541f23e3050412f88b4bc316c91fa98930fea02491981fa3280128425fd699244f0c558a2f196695da11ec6998da75de638358e189490d52bd
SSDEEP

3072:jEGh0oblfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGNl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321e-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000023227-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002322e-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023227-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002322e-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002177b-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002177d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070b-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00150000000006c1-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070b-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00160000000006c1-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00030000000006e1-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{974A254A-5F7B-40d7-961F-64A0B70CD361}\stubpath = "C:\\Windows\\{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe"	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E4183F-6704-4eb0-91C1-F59079FAEC28}	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85D8B6D9-84DD-4812-90B3-71F207D97649}	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D67958A6-37E2-422c-BA33-A679EDE06C25}\stubpath = "C:\\Windows\\{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe"	{32467808-3A43-415e-BE33-760DD2A5633E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75A2A211-F884-4e8f-98AA-17D59084A6D2}	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}\stubpath = "C:\\Windows\\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe"	{0153F351-D99A-460a-8131-5A798078E206}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85D8B6D9-84DD-4812-90B3-71F207D97649}\stubpath = "C:\\Windows\\{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe"	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32467808-3A43-415e-BE33-760DD2A5633E}\stubpath = "C:\\Windows\\{32467808-3A43-415e-BE33-760DD2A5633E}.exe"	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D67958A6-37E2-422c-BA33-A679EDE06C25}	{32467808-3A43-415e-BE33-760DD2A5633E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75A2A211-F884-4e8f-98AA-17D59084A6D2}\stubpath = "C:\\Windows\\{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe"	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}\stubpath = "C:\\Windows\\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe"	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{974A254A-5F7B-40d7-961F-64A0B70CD361}	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}\stubpath = "C:\\Windows\\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe"	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0153F351-D99A-460a-8131-5A798078E206}	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}	{0153F351-D99A-460a-8131-5A798078E206}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}\stubpath = "C:\\Windows\\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe"	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20A1DADD-4208-4e76-99B4-A0283343598C}	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20A1DADD-4208-4e76-99B4-A0283343598C}\stubpath = "C:\\Windows\\{20A1DADD-4208-4e76-99B4-A0283343598C}.exe"	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E4183F-6704-4eb0-91C1-F59079FAEC28}\stubpath = "C:\\Windows\\{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe"	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32467808-3A43-415e-BE33-760DD2A5633E}	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0153F351-D99A-460a-8131-5A798078E206}\stubpath = "C:\\Windows\\{0153F351-D99A-460a-8131-5A798078E206}.exe"	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe

Executes dropped EXE 12 IoCs

pid	Process
4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe
4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
1556	{0153F351-D99A-460a-8131-5A798078E206}.exe
3144	{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
File created	C:\Windows\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
File created	C:\Windows\{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
File created	C:\Windows\{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
File created	C:\Windows\{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
File created	C:\Windows\{32467808-3A43-415e-BE33-760DD2A5633E}.exe	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
File created	C:\Windows\{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	{32467808-3A43-415e-BE33-760DD2A5633E}.exe
File created	C:\Windows\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
File created	C:\Windows\{0153F351-D99A-460a-8131-5A798078E206}.exe	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
File created	C:\Windows\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe	{0153F351-D99A-460a-8131-5A798078E206}.exe
File created	C:\Windows\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
File created	C:\Windows\{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
Token: SeIncBasePriorityPrivilege	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
Token: SeIncBasePriorityPrivilege	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
Token: SeIncBasePriorityPrivilege	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
Token: SeIncBasePriorityPrivilege	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
Token: SeIncBasePriorityPrivilege	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
Token: SeIncBasePriorityPrivilege	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe
Token: SeIncBasePriorityPrivilege	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
Token: SeIncBasePriorityPrivilege	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
Token: SeIncBasePriorityPrivilege	2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
Token: SeIncBasePriorityPrivilege	1556	{0153F351-D99A-460a-8131-5A798078E206}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4732	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	89
PID 2772 wrote to memory of 4732	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	89
PID 2772 wrote to memory of 4732	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	89
PID 2772 wrote to memory of 4808	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	90
PID 2772 wrote to memory of 4808	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	90
PID 2772 wrote to memory of 4808	2772	2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe	90
PID 4732 wrote to memory of 748	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	93
PID 4732 wrote to memory of 748	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	93
PID 4732 wrote to memory of 748	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	93
PID 4732 wrote to memory of 1736	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	94
PID 4732 wrote to memory of 1736	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	94
PID 4732 wrote to memory of 1736	4732	{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe	94
PID 748 wrote to memory of 4044	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	97
PID 748 wrote to memory of 4044	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	97
PID 748 wrote to memory of 4044	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	97
PID 748 wrote to memory of 1048	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	96
PID 748 wrote to memory of 1048	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	96
PID 748 wrote to memory of 1048	748	{20A1DADD-4208-4e76-99B4-A0283343598C}.exe	96
PID 4044 wrote to memory of 3360	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	98
PID 4044 wrote to memory of 3360	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	98
PID 4044 wrote to memory of 3360	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	98
PID 4044 wrote to memory of 4564	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	99
PID 4044 wrote to memory of 4564	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	99
PID 4044 wrote to memory of 4564	4044	{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe	99
PID 3360 wrote to memory of 452	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	100
PID 3360 wrote to memory of 452	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	100
PID 3360 wrote to memory of 452	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	100
PID 3360 wrote to memory of 4968	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	101
PID 3360 wrote to memory of 4968	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	101
PID 3360 wrote to memory of 4968	3360	{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe	101
PID 452 wrote to memory of 3984	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	102
PID 452 wrote to memory of 3984	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	102
PID 452 wrote to memory of 3984	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	102
PID 452 wrote to memory of 3352	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	103
PID 452 wrote to memory of 3352	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	103
PID 452 wrote to memory of 3352	452	{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe	103
PID 3984 wrote to memory of 4468	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	104
PID 3984 wrote to memory of 4468	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	104
PID 3984 wrote to memory of 4468	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	104
PID 3984 wrote to memory of 4052	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	105
PID 3984 wrote to memory of 4052	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	105
PID 3984 wrote to memory of 4052	3984	{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe	105
PID 4468 wrote to memory of 4552	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	106
PID 4468 wrote to memory of 4552	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	106
PID 4468 wrote to memory of 4552	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	106
PID 4468 wrote to memory of 3520	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	107
PID 4468 wrote to memory of 3520	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	107
PID 4468 wrote to memory of 3520	4468	{32467808-3A43-415e-BE33-760DD2A5633E}.exe	107
PID 4552 wrote to memory of 4548	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	108
PID 4552 wrote to memory of 4548	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	108
PID 4552 wrote to memory of 4548	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	108
PID 4552 wrote to memory of 3024	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	109
PID 4552 wrote to memory of 3024	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	109
PID 4552 wrote to memory of 3024	4552	{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe	109
PID 4548 wrote to memory of 2956	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	110
PID 4548 wrote to memory of 2956	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	110
PID 4548 wrote to memory of 2956	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	110
PID 4548 wrote to memory of 4168	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	111
PID 4548 wrote to memory of 4168	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	111
PID 4548 wrote to memory of 4168	4548	{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe	111
PID 2956 wrote to memory of 1556	2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe	113
PID 2956 wrote to memory of 1556	2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe	113
PID 2956 wrote to memory of 1556	2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe	113
PID 2956 wrote to memory of 3416	2956	{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_519a9ee44e1923b099f49d5da225601d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
  C:\Windows\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
    C:\Windows\{20A1DADD-4208-4e76-99B4-A0283343598C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{20A1D~1.EXE > nul
      4⤵
      PID:1048
  - - C:\Windows\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
      C:\Windows\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\Windows\{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
        
        C:\Windows\{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3360
      - C:\Windows\{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
        
        C:\Windows\{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
        
        C:\Windows\{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\{32467808-3A43-415e-BE33-760DD2A5633E}.exe
        
        C:\Windows\{32467808-3A43-415e-BE33-760DD2A5633E}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
        
        C:\Windows\{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
        
        C:\Windows\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
        
        C:\Windows\{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{75A2A~1.EXE > nul
        12⤵
        
        PID:3416
        
        C:\Windows\{0153F351-D99A-460a-8131-5A798078E206}.exe
        
        C:\Windows\{0153F351-D99A-460a-8131-5A798078E206}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe
        
        C:\Windows\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe
        13⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0153F~1.EXE > nul
        13⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D615C~1.EXE > nul
        11⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6795~1.EXE > nul
        10⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32467~1.EXE > nul
        9⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85D8B~1.EXE > nul
        8⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96E41~1.EXE > nul
        7⤵
        
        PID:3352
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{974A2~1.EXE > nul
        6⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F00DF~1.EXE > nul
        5⤵
        
        PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{91A81~1.EXE > nul
    3⤵
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0153F351-D99A-460a-8131-5A798078E206}.exe

Filesize
180KB

MD5
44a08503c841eea25c6e93942780fc04

SHA1
d1b11233b86a4d75b8f5a4c56fe6fe4a72ebdbc2

SHA256
d354770e4f27b21e5d8a8bdc94ea6664cb212e284540937a57eaa929a0e5413a

SHA512
92b2112aa4f0d82950f9a82850b6bc424674e7d3088004f497abede432c1e32a74633506fe74dd921d3c06e3b763e9f26f5d1f0f52b622b8d5bdf1f1d196e699

Download Submit
C:\Windows\{20A1DADD-4208-4e76-99B4-A0283343598C}.exe

Filesize
180KB

MD5
35e4775017166c91600b12335c4cf932

SHA1
4501bbd966d79d77c857cdd807bfb7651ff10a32

SHA256
53d2eb776519ddd46e3f4850586696d696102d4eae795926426b836768f0e9b4

SHA512
96fa10eca97c9536738011a070dae95b98fd03275417e538c05f54b9b4fb2795fddb3eab19b1db8c2ce211f118cfceef20efbb17b83901fc1387eade633f8781

Download Submit
C:\Windows\{32467808-3A43-415e-BE33-760DD2A5633E}.exe

Filesize
180KB

MD5
70daee495c063816f4e6603d3bafd01f

SHA1
00337d1bb5a77ce17f2b127c57d6237882141896

SHA256
36346e64137840b757492e1fda6b9eb65f5f6f35dbf16c8e187c1c0b5477c342

SHA512
abeccef1f9efe3d014fb8190644c4d0e1f1bcfa3799ad5f5b6284700bec9564fc0ac5ac68cb9b8da4b772cd81615f0b3b020f35047bd890e09757259743599c5

Download Submit
C:\Windows\{3CAF6CC4-BDE1-4e9a-AF48-AE126069CAC7}.exe

Filesize
180KB

MD5
488d5234adc34a3f9d6ef6ba5f0c4749

SHA1
46fa6dd7fb0dcd8da3f3d9ae67bc81e957653c28

SHA256
243dbdc1e7ab0db9a9e146f850a596d891cb925b82efab13708e9e6513eee87b

SHA512
b145bc7056a915bc675b130dfe02a0a149afc019caf7097c5151cc3ffe3b28835aa6561f6b4c49b4ab3752a331a731bcdfecf66ec5142f2af628a71a65dfd3a0

Download Submit
C:\Windows\{75A2A211-F884-4e8f-98AA-17D59084A6D2}.exe

Filesize
180KB

MD5
ed36152cfa220640040e274a84fb687d

SHA1
3b114dca526862e61f8e2942a24445d086fe4496

SHA256
ea397eb4535d1ed88f2892fc98da3eb55aad0ac624b25faa55b1ec04adf66e46

SHA512
e849e9c02cc2ac817d6722459bb7657a751fb6ad4a42713a5ecad48a2aa3648ebef1d12015169ee4b47713f3c834d6ab804c80be8fa3837872f4653a8db094cf

Download Submit
C:\Windows\{85D8B6D9-84DD-4812-90B3-71F207D97649}.exe

Filesize
180KB

MD5
39c63dbf865f78d0586b62878c31bca3

SHA1
48e696637c5b7ed6c39c18183cdabc25f3d03810

SHA256
7d1c48fc8418f13aef69fec6bd5f5984b4b2d9927826048a66c3d5ae30f92732

SHA512
2e24b0a783979b64ca5b1fa548a67529b9bdd9f232376d1c593e922bbc9c089b0b81ec07326cb8fd8b517a831542312e8d901b4826314fe56d556609d12e784b

Download Submit
C:\Windows\{91A81D3E-4F20-4bc6-8647-E31A9C0D7457}.exe

Filesize
180KB

MD5
ef1c363993b4562b4ba64ed4ad696269

SHA1
a1b3fd529a4a15d524ea60efdcedcea843b9488d

SHA256
36bdea6c6888b686feb12fd02b6ac1a9f20eacf2f9a59dd9f6c42c237c806bfa

SHA512
c84bbea51613dcb3e791a929a1aa9d00df0fabc50117dc91670c07f959e7d16d21319698137052b7d9353e9f8b81f1f583a75e4b9411086f61b95e2d1c2de33b

Download Submit
C:\Windows\{96E4183F-6704-4eb0-91C1-F59079FAEC28}.exe

Filesize
180KB

MD5
851f65837c0e1134336027b9dd74dd6f

SHA1
0ff1b09e451b3328d634ecdf90e800ecfa9beee6

SHA256
629e268c969471015bca6fc1a8a188a76997603226c1be5cf0da7ba2b518edf8

SHA512
622a75f88974f8afe60ec29a0e1fb0f5f14c36eea3fe3d53f3069d8a10d347bdb93c17e79698827b214343cf3ec30cc718adf6f54f97c3e23841a41c66f7c5bd

Download Submit
C:\Windows\{974A254A-5F7B-40d7-961F-64A0B70CD361}.exe

Filesize
180KB

MD5
4d91236d0fd61bc1a8e7488f5b37d513

SHA1
857c2c7505e1f07aeecd22780d4c0b63bd60ad40

SHA256
0fe12d1caafe6491d3a2d24b87985e6b99c69d56104eb2f7c2d2c02fd120c824

SHA512
89cbdbfcfadd7e145ddc0b3e9810db716498717bd12bda1ce0fc4bb2f414fdc7de399dc412405407e3cab0535ddf83779f15fda1f9aa60f69c29473e4a7bca5f

Download Submit
C:\Windows\{D615C0C5-C6DC-41c1-9857-2D50DE674A06}.exe

Filesize
180KB

MD5
8109d609d23d4cb9c1ba0bdc3626db81

SHA1
1298995c7665dd947953e8dfbbc71293477dc5fc

SHA256
6d7d33bd7459188ca89d556ca6f20f54eb9033d892e206f2df9431670a5b91d2

SHA512
e9d6a87cc35b43705f3951b17bcd51aa49a7fc959269c538c3decbf60a33617b831dbc7bf0048f7103ccb9969b2f46dea2de8663970fd666093ed5fd23b31754

Download Submit
C:\Windows\{D67958A6-37E2-422c-BA33-A679EDE06C25}.exe

Filesize
180KB

MD5
7e8314490daf4664571a91c3070640c7

SHA1
2f6ff00ef749dec4131c9c2c7d4e4993f9ab50db

SHA256
22e2f02f30bba0ccf1b83cf674cfb44fb947623445b2b011dfe3c70c49a3292c

SHA512
aa19df10f84556a8fe9e316fb67eaf93c2f9e3a594a3502a8eba3f6a33a8c6ccccb1fc9d0b48a5ecfecbc431f5e226e89663fd0068ef9e95c91898c6e2eb8b0e

Download Submit
C:\Windows\{F00DFE07-1AAC-4661-B06A-CBC2D1934867}.exe

Filesize
180KB

MD5
a8264e122e7cbaae324665f04477fce7

SHA1
d48cb23bc533e279e01a35f7661d38e73626a483

SHA256
58397730d759905a90b6572b344b7e8564593a6ff9004f7399b5abacdb061d1a

SHA512
39a39ac9d6e2cd9c3b50787ce86107761cb320bffe4ee70cd034ea72d3528f511b7a6869492c80978c0516e8af0dba74f985a1117a13dafabfc573c38130b145

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads