fdb331f2bee4b384b5408a809a9e178be3c88d6374f2760affdbc89d15c7f2dc

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
Size

216KB
MD5

e40246686f7503a3bc0b727de379c68f
SHA1

569d7140140c9dd957442b2e566ed54bcc1cd95b
SHA256

fdb331f2bee4b384b5408a809a9e178be3c88d6374f2760affdbc89d15c7f2dc
SHA512

cd99c4970962ab61ea74b76d98ceb9c4bd97c5d1108cf225942e8e67aefb2fa793b61d5a0b3b1629b43a9e9dd3d20fa43a8b64bc7575de33780e4a48b49cd7eb
SSDEEP

3072:jEGh0oDl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGJlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001529f-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00080000000155df-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6f8-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001529f-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000f6f8-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000001529f-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000000f6f8-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000001529f-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f8-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001300000001529f-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45371C92-BFDE-4829-9E83-787F3FB50010}\stubpath = "C:\\Windows\\{45371C92-BFDE-4829-9E83-787F3FB50010}.exe"	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}\stubpath = "C:\\Windows\\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe"	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A809FF51-BE04-4ca1-AF10-A53398C1C626}	{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14813934-70D5-4c0e-9626-783A966A12FE}\stubpath = "C:\\Windows\\{14813934-70D5-4c0e-9626-783A966A12FE}.exe"	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1898162F-227C-417e-91E1-B71C3BECDC22}	{14813934-70D5-4c0e-9626-783A966A12FE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF75224-0590-41d8-B93D-108D1A626AB6}\stubpath = "C:\\Windows\\{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe"	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45371C92-BFDE-4829-9E83-787F3FB50010}	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14813934-70D5-4c0e-9626-783A966A12FE}	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}\stubpath = "C:\\Windows\\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe"	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}\stubpath = "C:\\Windows\\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe"	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1382B205-F653-4dfb-B77E-68F8AF88C810}\stubpath = "C:\\Windows\\{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe"	{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}	{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}\stubpath = "C:\\Windows\\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe"	{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF75224-0590-41d8-B93D-108D1A626AB6}	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}\stubpath = "C:\\Windows\\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe"	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A809FF51-BE04-4ca1-AF10-A53398C1C626}\stubpath = "C:\\Windows\\{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe"	{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1382B205-F653-4dfb-B77E-68F8AF88C810}	{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1898162F-227C-417e-91E1-B71C3BECDC22}\stubpath = "C:\\Windows\\{1898162F-227C-417e-91E1-B71C3BECDC22}.exe"	{14813934-70D5-4c0e-9626-783A966A12FE}.exe

Deletes itself 1 IoCs

pid	Process
2088	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe
2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
2996	{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
1400	{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
2936	{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
2348	{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe	{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
File created	C:\Windows\{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe	{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
File created	C:\Windows\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe	{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
File created	C:\Windows\{14813934-70D5-4c0e-9626-783A966A12FE}.exe	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
File created	C:\Windows\{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
File created	C:\Windows\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
File created	C:\Windows\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
File created	C:\Windows\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
File created	C:\Windows\{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	{14813934-70D5-4c0e-9626-783A966A12FE}.exe
File created	C:\Windows\{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
File created	C:\Windows\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe
Token: SeIncBasePriorityPrivilege	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
Token: SeIncBasePriorityPrivilege	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
Token: SeIncBasePriorityPrivilege	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
Token: SeIncBasePriorityPrivilege	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
Token: SeIncBasePriorityPrivilege	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
Token: SeIncBasePriorityPrivilege	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
Token: SeIncBasePriorityPrivilege	2996	{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
Token: SeIncBasePriorityPrivilege	1400	{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
Token: SeIncBasePriorityPrivilege	2936	{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2912	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	28
PID 1380 wrote to memory of 2912	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	28
PID 1380 wrote to memory of 2912	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	28
PID 1380 wrote to memory of 2912	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	28
PID 1380 wrote to memory of 2088	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	29
PID 1380 wrote to memory of 2088	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	29
PID 1380 wrote to memory of 2088	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	29
PID 1380 wrote to memory of 2088	1380	2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe	29
PID 2912 wrote to memory of 2640	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	30
PID 2912 wrote to memory of 2640	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	30
PID 2912 wrote to memory of 2640	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	30
PID 2912 wrote to memory of 2640	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	30
PID 2912 wrote to memory of 2032	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	31
PID 2912 wrote to memory of 2032	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	31
PID 2912 wrote to memory of 2032	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	31
PID 2912 wrote to memory of 2032	2912	{14813934-70D5-4c0e-9626-783A966A12FE}.exe	31
PID 2640 wrote to memory of 2536	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	34
PID 2640 wrote to memory of 2536	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	34
PID 2640 wrote to memory of 2536	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	34
PID 2640 wrote to memory of 2536	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	34
PID 2640 wrote to memory of 2592	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	35
PID 2640 wrote to memory of 2592	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	35
PID 2640 wrote to memory of 2592	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	35
PID 2640 wrote to memory of 2592	2640	{1898162F-227C-417e-91E1-B71C3BECDC22}.exe	35
PID 2536 wrote to memory of 524	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	36
PID 2536 wrote to memory of 524	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	36
PID 2536 wrote to memory of 524	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	36
PID 2536 wrote to memory of 524	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	36
PID 2536 wrote to memory of 268	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	37
PID 2536 wrote to memory of 268	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	37
PID 2536 wrote to memory of 268	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	37
PID 2536 wrote to memory of 268	2536	{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe	37
PID 524 wrote to memory of 1412	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	39
PID 524 wrote to memory of 1412	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	39
PID 524 wrote to memory of 1412	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	39
PID 524 wrote to memory of 1412	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	39
PID 524 wrote to memory of 2840	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	38
PID 524 wrote to memory of 2840	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	38
PID 524 wrote to memory of 2840	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	38
PID 524 wrote to memory of 2840	524	{45371C92-BFDE-4829-9E83-787F3FB50010}.exe	38
PID 1412 wrote to memory of 1732	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	40
PID 1412 wrote to memory of 1732	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	40
PID 1412 wrote to memory of 1732	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	40
PID 1412 wrote to memory of 1732	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	40
PID 1412 wrote to memory of 1624	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	41
PID 1412 wrote to memory of 1624	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	41
PID 1412 wrote to memory of 1624	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	41
PID 1412 wrote to memory of 1624	1412	{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe	41
PID 1732 wrote to memory of 1932	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	42
PID 1732 wrote to memory of 1932	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	42
PID 1732 wrote to memory of 1932	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	42
PID 1732 wrote to memory of 1932	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	42
PID 1732 wrote to memory of 2204	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	43
PID 1732 wrote to memory of 2204	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	43
PID 1732 wrote to memory of 2204	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	43
PID 1732 wrote to memory of 2204	1732	{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe	43
PID 1932 wrote to memory of 2996	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	44
PID 1932 wrote to memory of 2996	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	44
PID 1932 wrote to memory of 2996	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	44
PID 1932 wrote to memory of 2996	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	44
PID 1932 wrote to memory of 1608	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	45
PID 1932 wrote to memory of 1608	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	45
PID 1932 wrote to memory of 1608	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	45
PID 1932 wrote to memory of 1608	1932	{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_e40246686f7503a3bc0b727de379c68f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\{14813934-70D5-4c0e-9626-783A966A12FE}.exe
  C:\Windows\{14813934-70D5-4c0e-9626-783A966A12FE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
    C:\Windows\{1898162F-227C-417e-91E1-B71C3BECDC22}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
      C:\Windows\{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
        
        C:\Windows\{45371C92-BFDE-4829-9E83-787F3FB50010}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:524
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45371~1.EXE > nul
        6⤵
        
        PID:2840
      - C:\Windows\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
        
        C:\Windows\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
        
        C:\Windows\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
        
        C:\Windows\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
        
        C:\Windows\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
        
        C:\Windows\{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
        
        C:\Windows\{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
        
        C:\Windows\{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
        
        C:\Windows\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe
        
        C:\Windows\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe
        12⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1382B~1.EXE > nul
        12⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A809F~1.EXE > nul
        11⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3851B~1.EXE > nul
        10⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D6EF~1.EXE > nul
        9⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CF5C5~1.EXE > nul
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A039~1.EXE > nul
        7⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBF75~1.EXE > nul
        5⤵
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{18981~1.EXE > nul
      4⤵
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{14813~1.EXE > nul
    3⤵
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1382B205-F653-4dfb-B77E-68F8AF88C810}.exe

Filesize
216KB

MD5
24eaf702e3b3cd64c0d815abd16217b9

SHA1
998ea7a26b84b3fef163de02c71f002589135516

SHA256
50d83d707c0c5296148d7722b1ac7a3f36ace92f7b13e0ba80f1a1c2d13391a4

SHA512
5fa44d88b9e4b6bb7ab1d883dafd5ec71e96df7838ae9e47e53a4e25e79b7334e57ac26f49857602c92d2b058c975e846f2ad1070697f3ab0daeb38235dfd7d0

Download Submit
C:\Windows\{14813934-70D5-4c0e-9626-783A966A12FE}.exe

Filesize
216KB

MD5
652064fc6f33af1eab932db3407e1bad

SHA1
431cf8ba84f70d4b54a43b885ea1505f059c4031

SHA256
4e95b78bc9837dff0da9acd55376ba18197a7d3449c566334732cc90ebbcf64e

SHA512
00b68a88105032e03eaa08dda4d46239a93d8203b2055d7fd406e8738f4fee229244a03cb9a746badffefc7183764f3cc8c7b475449084487491a599fb61f49a

Download Submit
C:\Windows\{1898162F-227C-417e-91E1-B71C3BECDC22}.exe

Filesize
216KB

MD5
1f2d7d0f9d085dc64d914235f0447428

SHA1
617f2d1a68c3df2274dccad25f3dad67056aadfd

SHA256
c67b286ebfb906364aed72d7035ff0e2b9617c6df073d40f90eb4f64b67bb6c5

SHA512
1f83095439ef47b86ed1bb7ba06006dd9d2f16ba6854127fab1f6a14c06deb348c6d0761341ce1d516c5b5fd11fefbf0d9da9552ca10c34993356791c515fe41

Download Submit
C:\Windows\{1A0393A2-4E8B-49f4-846D-78319BEA2C42}.exe

Filesize
216KB

MD5
8d94f4e83ee60ec9af7bec5c6ff0d758

SHA1
5c2bf6b86684d8f51b85f11ae30b3ed30ed38c12

SHA256
6bf2b4e906f330c69911d4f6b25e3baa8473176daea1daaa43bebad4d048a1eb

SHA512
d5f058752d2f36e01d65b5b39f0380690e05f955cbbbfe2b4d6864b678cbe4cdb99e8fbfb0e36ae358d69ff6db78db74e3b1ebbf2119588ff5a81586d4445d9e

Download Submit
C:\Windows\{3851B9C0-03CE-4748-BE8E-92BD95F8FE7C}.exe

Filesize
216KB

MD5
a69dc50aa52c3432d89a3875be9ed4c1

SHA1
4275c0eb6b7c9c219626104e7b139cc77930e802

SHA256
6ab9a62576b1bd0ac6452b1e028f4b27d9ae409a059bc6b202afe11bf55d9277

SHA512
d8ba59c389fc05d48745306c9e3bea0809327edcc741de73b61964c297c4516c3d4d839ce03068d536e2a9f516497f3c063ad045aa0066464e1b07efdede816e

Download Submit
C:\Windows\{45371C92-BFDE-4829-9E83-787F3FB50010}.exe

Filesize
216KB

MD5
07baa382c68f1523a00aad064dd68b74

SHA1
a73ca042327f8123360af301b03c63664390b175

SHA256
19917626e233c596d185cbd1763234a0bb27370c160d0506b3b7664acfa5e3ed

SHA512
e5e7189501a9f85aa76e073384c02af5692e08a31e3859e8224312f6fdb4c773a8acc7e887f838d7f93f8fe4342e5e10eed4f9bf3ca267730675e564b9ba16af

Download Submit
C:\Windows\{5D6EF25A-31A9-45ca-88ED-6B82AEA0A3C9}.exe

Filesize
216KB

MD5
fd5b35a327a96263bab31a5e3bc9772c

SHA1
be9dfefadf0171186c3e2e96ea5298c95c6c46b0

SHA256
22617f1fbeed07b5fe4a1b007a581ac664ebf58685fc82a2bab78b950f9ad7ad

SHA512
142ce6572c590f137606f650eb53622a0ce0c4cac87f373c963ae8c14844690f15e47591d290f5a12d7028b66a741e7125da4beb2a675ee4ef84064f87f4f410

Download Submit
C:\Windows\{A809FF51-BE04-4ca1-AF10-A53398C1C626}.exe

Filesize
216KB

MD5
483ee6c9eee19553587c6abca0876ac2

SHA1
311c5b08352031aff9e4f3dcc3fa347672a53251

SHA256
e64024c42d91214ca4b75491165c57879a86c0ddacd6316fac4a7aef550dd110

SHA512
e85690cbd4019dc2ee98cd8db9f9d45eb411003ed65ab1cc4b884d6991a7f875b104d071b96963ed8b01ad96e214f02807437d8fb5e3aac74308f8bda99fd8e4

Download Submit
C:\Windows\{ACD8DD35-E870-4142-8ACE-591DB22D2CA6}.exe

Filesize
216KB

MD5
ce19336d35eeb0506dce55fbeb804c67

SHA1
2c87b4e34801a988ce65f6d85548abed5abd7afd

SHA256
7996d70f7d2d54795887882b6fb77056fb424791e7031e0422b3255d0d4b3c2d

SHA512
9f61bc8ab08bd0567ca4584260fd992f202a482b9b945362881c0f05e860e47cf5ff17cce73e59fda1a721cf5de06d529cc4582b35723b8ac5c75bc9fa115cd5

Download Submit
C:\Windows\{CBF75224-0590-41d8-B93D-108D1A626AB6}.exe

Filesize
216KB

MD5
a9a93684585cf577b771fe0265f7a084

SHA1
04759125e4f2c71da127bb0fc52ceef5d4457e5a

SHA256
ac6f3268c6fc417451b70739ef3d010f9bb547f448fab284473d39f708e8ec65

SHA512
ebbfaa1b93f44bbe1dfef15f3e7d48502997ed52638e72d1e56836c4f7347939ced40db4401bd6ac95f92e53886939593d2569bc661bbdfcbc896a4a01521fd1

Download Submit
C:\Windows\{CF5C563F-C2CE-46ed-AE63-94DA98A43F01}.exe

Filesize
216KB

MD5
1b4d9a9d90153417b65caa685809b412

SHA1
7c921bb18f307ce16d0b95f29fcc218ae4aac2d0

SHA256
f3ff5abf48e6ed429165f9a694509d237cb823d859b5869fb4fbd154e962cb2d

SHA512
09db1ac41c927ecb32a269c950ff77316fc8430c00e3cb7551644d66294ae8d349bd7138e40a5333db83e0d91373c129173247d01e170c48b02af88c495d3822

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads