71b3c9721773a2ac6067f205ef667729eb7514d05b9a40552f82e73280eac878

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
Size

216KB
MD5

8b9b99c59a3c7c70124284ee523f822c
SHA1

983b62033684a530f2c0ad920d136661a3711741
SHA256

71b3c9721773a2ac6067f205ef667729eb7514d05b9a40552f82e73280eac878
SHA512

a8b7c72215b954ee10a90eb4539d3a7ae0f6141cbaa52b7ac7a61c5ad79886ba94ad3b2469c796d15b21bb032120ce5066aaacfcfa7c52e2e83919521068d925
SSDEEP

3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGPlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012270-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015e9f-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000016047-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002900000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000016047-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000001604f-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000016047-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000001604f-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000016047-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000001604f-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}\stubpath = "C:\\Windows\\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe"	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB475CB7-0782-4290-8703-CE86E065062D}	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}	{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{970477DD-C566-438f-9F44-D52CBDE34F32}	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}\stubpath = "C:\\Windows\\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe"	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AB475CB7-0782-4290-8703-CE86E065062D}\stubpath = "C:\\Windows\\{AB475CB7-0782-4290-8703-CE86E065062D}.exe"	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4130E684-8FCE-4510-8771-964C9092DD79}	{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4130E684-8FCE-4510-8771-964C9092DD79}\stubpath = "C:\\Windows\\{4130E684-8FCE-4510-8771-964C9092DD79}.exe"	{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{970477DD-C566-438f-9F44-D52CBDE34F32}\stubpath = "C:\\Windows\\{970477DD-C566-438f-9F44-D52CBDE34F32}.exe"	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}\stubpath = "C:\\Windows\\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe"	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}\stubpath = "C:\\Windows\\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe"	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}	{4130E684-8FCE-4510-8771-964C9092DD79}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}\stubpath = "C:\\Windows\\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe"	{4130E684-8FCE-4510-8771-964C9092DD79}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}\stubpath = "C:\\Windows\\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe"	{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}\stubpath = "C:\\Windows\\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe"	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}	{AB475CB7-0782-4290-8703-CE86E065062D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}\stubpath = "C:\\Windows\\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe"	{AB475CB7-0782-4290-8703-CE86E065062D}.exe

Deletes itself 1 IoCs

pid	Process
2256	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe
1640	{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
1364	{4130E684-8FCE-4510-8771-964C9092DD79}.exe
2816	{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
3024	{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
File created	C:\Windows\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
File created	C:\Windows\{AB475CB7-0782-4290-8703-CE86E065062D}.exe	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
File created	C:\Windows\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe	{AB475CB7-0782-4290-8703-CE86E065062D}.exe
File created	C:\Windows\{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
File created	C:\Windows\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
File created	C:\Windows\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
File created	C:\Windows\{4130E684-8FCE-4510-8771-964C9092DD79}.exe	{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
File created	C:\Windows\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe	{4130E684-8FCE-4510-8771-964C9092DD79}.exe
File created	C:\Windows\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe	{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
File created	C:\Windows\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
Token: SeIncBasePriorityPrivilege	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
Token: SeIncBasePriorityPrivilege	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
Token: SeIncBasePriorityPrivilege	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
Token: SeIncBasePriorityPrivilege	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
Token: SeIncBasePriorityPrivilege	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
Token: SeIncBasePriorityPrivilege	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe
Token: SeIncBasePriorityPrivilege	1640	{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
Token: SeIncBasePriorityPrivilege	1364	{4130E684-8FCE-4510-8771-964C9092DD79}.exe
Token: SeIncBasePriorityPrivilege	2816	{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2388	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	28
PID 1016 wrote to memory of 2388	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	28
PID 1016 wrote to memory of 2388	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	28
PID 1016 wrote to memory of 2388	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	28
PID 1016 wrote to memory of 2256	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	29
PID 1016 wrote to memory of 2256	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	29
PID 1016 wrote to memory of 2256	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	29
PID 1016 wrote to memory of 2256	1016	2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe	29
PID 2388 wrote to memory of 2704	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	30
PID 2388 wrote to memory of 2704	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	30
PID 2388 wrote to memory of 2704	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	30
PID 2388 wrote to memory of 2704	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	30
PID 2388 wrote to memory of 2780	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	31
PID 2388 wrote to memory of 2780	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	31
PID 2388 wrote to memory of 2780	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	31
PID 2388 wrote to memory of 2780	2388	{970477DD-C566-438f-9F44-D52CBDE34F32}.exe	31
PID 2704 wrote to memory of 3036	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	34
PID 2704 wrote to memory of 3036	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	34
PID 2704 wrote to memory of 3036	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	34
PID 2704 wrote to memory of 3036	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	34
PID 2704 wrote to memory of 2728	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	35
PID 2704 wrote to memory of 2728	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	35
PID 2704 wrote to memory of 2728	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	35
PID 2704 wrote to memory of 2728	2704	{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe	35
PID 3036 wrote to memory of 2684	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	36
PID 3036 wrote to memory of 2684	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	36
PID 3036 wrote to memory of 2684	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	36
PID 3036 wrote to memory of 2684	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	36
PID 3036 wrote to memory of 2120	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	37
PID 3036 wrote to memory of 2120	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	37
PID 3036 wrote to memory of 2120	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	37
PID 3036 wrote to memory of 2120	3036	{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe	37
PID 2684 wrote to memory of 1588	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	38
PID 2684 wrote to memory of 1588	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	38
PID 2684 wrote to memory of 1588	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	38
PID 2684 wrote to memory of 1588	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	38
PID 2684 wrote to memory of 324	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	39
PID 2684 wrote to memory of 324	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	39
PID 2684 wrote to memory of 324	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	39
PID 2684 wrote to memory of 324	2684	{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe	39
PID 1588 wrote to memory of 1564	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	40
PID 1588 wrote to memory of 1564	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	40
PID 1588 wrote to memory of 1564	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	40
PID 1588 wrote to memory of 1564	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	40
PID 1588 wrote to memory of 1944	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	41
PID 1588 wrote to memory of 1944	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	41
PID 1588 wrote to memory of 1944	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	41
PID 1588 wrote to memory of 1944	1588	{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe	41
PID 1564 wrote to memory of 1868	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	42
PID 1564 wrote to memory of 1868	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	42
PID 1564 wrote to memory of 1868	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	42
PID 1564 wrote to memory of 1868	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	42
PID 1564 wrote to memory of 768	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	43
PID 1564 wrote to memory of 768	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	43
PID 1564 wrote to memory of 768	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	43
PID 1564 wrote to memory of 768	1564	{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe	43
PID 1868 wrote to memory of 1640	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	44
PID 1868 wrote to memory of 1640	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	44
PID 1868 wrote to memory of 1640	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	44
PID 1868 wrote to memory of 1640	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	44
PID 1868 wrote to memory of 2872	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	45
PID 1868 wrote to memory of 2872	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	45
PID 1868 wrote to memory of 2872	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	45
PID 1868 wrote to memory of 2872	1868	{AB475CB7-0782-4290-8703-CE86E065062D}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_8b9b99c59a3c7c70124284ee523f822c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
  C:\Windows\{970477DD-C566-438f-9F44-D52CBDE34F32}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
    C:\Windows\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
      C:\Windows\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
        
        C:\Windows\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
      - C:\Windows\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
        
        C:\Windows\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
        
        C:\Windows\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\{AB475CB7-0782-4290-8703-CE86E065062D}.exe
        
        C:\Windows\{AB475CB7-0782-4290-8703-CE86E065062D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
        
        C:\Windows\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\{4130E684-8FCE-4510-8771-964C9092DD79}.exe
        
        C:\Windows\{4130E684-8FCE-4510-8771-964C9092DD79}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Windows\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
        
        C:\Windows\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BEF89~1.EXE > nul
        12⤵
        
        PID:288
        
        C:\Windows\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe
        
        C:\Windows\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe
        12⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4130E~1.EXE > nul
        11⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62E26~1.EXE > nul
        10⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AB475~1.EXE > nul
        9⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44F83~1.EXE > nul
        8⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60B67~1.EXE > nul
        7⤵
        
        PID:1944
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68FE0~1.EXE > nul
        6⤵
        
        PID:324
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F995B~1.EXE > nul
        5⤵
        
        PID:2120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{417D6~1.EXE > nul
      4⤵
      PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{97047~1.EXE > nul
    3⤵
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{4130E684-8FCE-4510-8771-964C9092DD79}.exe

Filesize
216KB

MD5
63d5fbbc2317c37e60cf778ccd1ec131

SHA1
497f40b4d90d4eaf441e21622026c2d5c9c6a595

SHA256
3ce241ccea3704698c8b2d2fb09929dc6c26be05e7ec349c69ccc398403b26da

SHA512
79e6354e815be3b471e2af2a5ae09d35ab148b05da1329e4bdbde18acc30f062adbe6be2ff751d08b128227300552cc661474e41c7488cbfb71bc48f47f25ffd

Download Submit
C:\Windows\{417D6EBE-E15F-40ad-904C-5BF71E7A89A9}.exe

Filesize
216KB

MD5
232aaae2ad8343139b00b2cf14f69dc4

SHA1
154f9b400b02fab2585a6773c7a723f21db4dd15

SHA256
658caed9f53644f2235a10e305b66aafbf38e1643b0e1f9d090292a3aa5ca180

SHA512
d1667671ef2ae136dc87774bc1bb19bad07c53eecba60fa3829fc73fb33b8c84ff2543b6992e6b074969be826ad63098101203e2ec0eb71269968677dd6cfbde

Download Submit
C:\Windows\{44F83AD6-ACCA-4775-9743-BD8B3B5F21EE}.exe

Filesize
216KB

MD5
56b1d522179d24dade65fd303cc26279

SHA1
c61e37fe910a781e67b95f3a8a3197a32009acb3

SHA256
379598e05c58f9428429abdd70a54026433e20141e17f4298b33b66ba73cdd5b

SHA512
f026822218d3a191719c062a26781a60ed4e44b405772aa45783cc76b0682c4612fa7f266ef88e08780920580207011f43835ba913b485683c6c9fcbf817ed9e

Download Submit
C:\Windows\{60B6791A-ECF0-4092-BA26-D530CE9E3DFC}.exe

Filesize
216KB

MD5
f0d931635329757189ea13150498e620

SHA1
75f277dba645b22dd5ae927b4a0c9393e5f76aae

SHA256
36fb3a4866193f1a810e4fc0d5b3e03f1ed9f797f57e1330ddfc4b16cf8fa0b8

SHA512
68f472ce627d6b942a8855141bf2d391bcc20beea58c760ddce3417db2f98d7fdef7e066a3bf086e05a353924c89038cf0ecff9f27af1dfda5c938ddebd704a5

Download Submit
C:\Windows\{62E26FDF-A3BF-40a1-A158-BE91709D3FB0}.exe

Filesize
216KB

MD5
d904bc273ee27656881924d7283c689e

SHA1
697418acb925e29dbf1db554b24e1dd6a4d33610

SHA256
6b7f782117178274a8694594fe1cc5fe7a99ca1db079db85e7bef6e255ac3313

SHA512
299fec6e6175f9ba8b085b16b97b3cc6ca2f576914dc8080c5caf325e79f280c3b70e1fec77dce2a11f795a704ce1b1efe33132e25f489c43eb6ca7db3e5b5be

Download Submit
C:\Windows\{68FE0DBB-8A4B-4aaa-A412-014D2E539043}.exe

Filesize
216KB

MD5
f2a1cc85f7787e3f227687f535518dda

SHA1
0a11b0514429896188e03b1304643d293c00d7f7

SHA256
b1e80bdf71c144a718a60d63fe2ebaf027c9b9338130f1ff5268b3feb59fbd34

SHA512
4be026923307e38d7f44aebb6b3b3e9f8ce78e4b35ddcb2cccc9bc6effefc46850573ec779c6b7c8d7fee9d161b376409b5542a6eda5d1c82ce3767a205ca9e7

Download Submit
C:\Windows\{970477DD-C566-438f-9F44-D52CBDE34F32}.exe

Filesize
216KB

MD5
2975cd037f89ef4d3b0fedee99f636c2

SHA1
c1b25ab4a9c759f7306b268bb28f452cc655f752

SHA256
46aa557d308395fa7536a3b100b998489c3c88100863edf85e892627aeb8f100

SHA512
0a5378936cf6a5721e66a8363271333f2c212c4eada55a1dc68144e4a69acab2829a1b445b9d13707dfbfcb62956312431f0108f24622e90b9d9f2854e83e7e1

Download Submit
C:\Windows\{AB475CB7-0782-4290-8703-CE86E065062D}.exe

Filesize
216KB

MD5
bf44ab061c96d862e7ddad0b6c80b5ca

SHA1
88eea775919f3fc51e999c8864310b77c98462b6

SHA256
230b8037709e6ad4f9344c20c098370fd77a208176c236d3879c34ccec608e2d

SHA512
8c35f1df8aaccad60c76cab017a7da1486219cb4306d92d8c310e961a43507199000126620b69217138617cdda2b7895d69e4a5af1e0a72062c527a66a09bdf3

Download Submit
C:\Windows\{BEF89E0D-3DB2-4088-99FE-908F30BC2559}.exe

Filesize
216KB

MD5
a966a16096531ed7bc2262dd653755d5

SHA1
d9be12ca9c9f60ce4523fcef53a8c3708f836178

SHA256
ba334c7293a23f9dbb752c66bf96bde93ff738d00f471be559d7a3b3b17dcb1e

SHA512
234282cfb4144499f73b6028ada070df4552acd456c9c70ab3fad3ad04dcd022ad4b4cbe0bd3babba8c77d9c2d2f5784933849c4624a94c53abbf728960dc7c3

Download Submit
C:\Windows\{D6B79562-5E94-4179-BA08-D6B4C6AFFBA9}.exe

Filesize
216KB

MD5
e117263ee1be5676f9df74bc81047bfb

SHA1
17a2e33f9174021d61ca22e94e977c7c2f7c48fc

SHA256
f32b1376344cb8075791a81ebc14d6f418d7dc6252097e198f4b1867d6fc1848

SHA512
e450a39d8c8349172abed1af73cef4b45e6694537737ae61f17f89463f8c91ef668244c6fffe0308193bc779fe2eeae6db117e69c09f5611b80a5ab5946d31d7

Download Submit
C:\Windows\{F995B4E3-C21D-4bcb-A2CF-F2FFE50EF20D}.exe

Filesize
216KB

MD5
f581d8763f2e15b2020902cbe1b22d00

SHA1
2da59a55faaf428c99616e0161d4f6ec15ef9e37

SHA256
ec8a1938ace52161dacdeb4d736d73c1abc86c1c2f8ff1cb1f0138182a3cb04b

SHA512
86a2bc620b239dde254ad31cfb934744a3ed19496e1ce76ccd7d9619d7ac3e0dceac0fe726dd620c84e970a5a2d0e2b47d9140022146fbe4065a39396a254cb3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads