b3eb380467aa727b235c8f9ae9dafa71839500f253a4c2072115611cf1124177

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
Size

216KB
MD5

96f7c4ea173f147d5dff08592d842d89
SHA1

a77b1dc13287a636dab6e77d7fdceba21a9a9f73
SHA256

b3eb380467aa727b235c8f9ae9dafa71839500f253a4c2072115611cf1124177
SHA512

d2ea826af104da57ba7eec81e1ea401029b74f3498c35aca3af842563d1527a7a597534cbad80f4e731a1194188844d4e8cc529e3bf36f23a84c7629da7850aa
SSDEEP

3072:jEGh0ogl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGWlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012261-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c85-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f7-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0003000000010f1d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000010f1d-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000010f1d-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000010f1d-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B67C6801-902B-4bca-849E-BD065D4620CD}	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}\stubpath = "C:\\Windows\\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe"	{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}\stubpath = "C:\\Windows\\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe"	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B67C6801-902B-4bca-849E-BD065D4620CD}\stubpath = "C:\\Windows\\{B67C6801-902B-4bca-849E-BD065D4620CD}.exe"	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}	{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}\stubpath = "C:\\Windows\\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe"	{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}\stubpath = "C:\\Windows\\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe"	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81295D3E-FE4D-438c-9182-88121BDC0ADF}	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D70108F8-DB42-46ca-90B1-7A300B23B267}	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}	{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}\stubpath = "C:\\Windows\\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe"	{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}	{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}\stubpath = "C:\\Windows\\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe"	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{81295D3E-FE4D-438c-9182-88121BDC0ADF}\stubpath = "C:\\Windows\\{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe"	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D70108F8-DB42-46ca-90B1-7A300B23B267}\stubpath = "C:\\Windows\\{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe"	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5A87E6C-F41F-4afe-8987-7267795978EC}	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5A87E6C-F41F-4afe-8987-7267795978EC}\stubpath = "C:\\Windows\\{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe"	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}\stubpath = "C:\\Windows\\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe"	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe

Deletes itself 1 IoCs

pid	Process
3032	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
568	{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
1356	{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
2864	{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe
2012	{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
File created	C:\Windows\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe	{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
File created	C:\Windows\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe	{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
File created	C:\Windows\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
File created	C:\Windows\{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
File created	C:\Windows\{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
File created	C:\Windows\{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
File created	C:\Windows\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
File created	C:\Windows\{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
File created	C:\Windows\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
File created	C:\Windows\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe	{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
Token: SeIncBasePriorityPrivilege	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
Token: SeIncBasePriorityPrivilege	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
Token: SeIncBasePriorityPrivilege	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
Token: SeIncBasePriorityPrivilege	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
Token: SeIncBasePriorityPrivilege	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
Token: SeIncBasePriorityPrivilege	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
Token: SeIncBasePriorityPrivilege	568	{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
Token: SeIncBasePriorityPrivilege	1356	{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
Token: SeIncBasePriorityPrivilege	2864	{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2200	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	28
PID 2192 wrote to memory of 2200	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	28
PID 2192 wrote to memory of 2200	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	28
PID 2192 wrote to memory of 2200	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	28
PID 2192 wrote to memory of 3032	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	29
PID 2192 wrote to memory of 3032	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	29
PID 2192 wrote to memory of 3032	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	29
PID 2192 wrote to memory of 3032	2192	2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe	29
PID 2200 wrote to memory of 2356	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	30
PID 2200 wrote to memory of 2356	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	30
PID 2200 wrote to memory of 2356	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	30
PID 2200 wrote to memory of 2356	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	30
PID 2200 wrote to memory of 2700	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	31
PID 2200 wrote to memory of 2700	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	31
PID 2200 wrote to memory of 2700	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	31
PID 2200 wrote to memory of 2700	2200	{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe	31
PID 2356 wrote to memory of 2944	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	35
PID 2356 wrote to memory of 2944	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	35
PID 2356 wrote to memory of 2944	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	35
PID 2356 wrote to memory of 2944	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	35
PID 2356 wrote to memory of 2500	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	34
PID 2356 wrote to memory of 2500	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	34
PID 2356 wrote to memory of 2500	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	34
PID 2356 wrote to memory of 2500	2356	{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe	34
PID 2944 wrote to memory of 2572	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	36
PID 2944 wrote to memory of 2572	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	36
PID 2944 wrote to memory of 2572	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	36
PID 2944 wrote to memory of 2572	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	36
PID 2944 wrote to memory of 2632	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	37
PID 2944 wrote to memory of 2632	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	37
PID 2944 wrote to memory of 2632	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	37
PID 2944 wrote to memory of 2632	2944	{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe	37
PID 2572 wrote to memory of 2536	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	38
PID 2572 wrote to memory of 2536	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	38
PID 2572 wrote to memory of 2536	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	38
PID 2572 wrote to memory of 2536	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	38
PID 2572 wrote to memory of 2624	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	39
PID 2572 wrote to memory of 2624	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	39
PID 2572 wrote to memory of 2624	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	39
PID 2572 wrote to memory of 2624	2572	{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe	39
PID 2536 wrote to memory of 2532	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	41
PID 2536 wrote to memory of 2532	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	41
PID 2536 wrote to memory of 2532	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	41
PID 2536 wrote to memory of 2532	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	41
PID 2536 wrote to memory of 1588	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	40
PID 2536 wrote to memory of 1588	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	40
PID 2536 wrote to memory of 1588	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	40
PID 2536 wrote to memory of 1588	2536	{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe	40
PID 2532 wrote to memory of 2044	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	43
PID 2532 wrote to memory of 2044	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	43
PID 2532 wrote to memory of 2044	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	43
PID 2532 wrote to memory of 2044	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	43
PID 2532 wrote to memory of 1944	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	42
PID 2532 wrote to memory of 1944	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	42
PID 2532 wrote to memory of 1944	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	42
PID 2532 wrote to memory of 1944	2532	{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe	42
PID 2044 wrote to memory of 568	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	44
PID 2044 wrote to memory of 568	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	44
PID 2044 wrote to memory of 568	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	44
PID 2044 wrote to memory of 568	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	44
PID 2044 wrote to memory of 2656	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	45
PID 2044 wrote to memory of 2656	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	45
PID 2044 wrote to memory of 2656	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	45
PID 2044 wrote to memory of 2656	2044	{B67C6801-902B-4bca-849E-BD065D4620CD}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_96f7c4ea173f147d5dff08592d842d89_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
  C:\Windows\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
    C:\Windows\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{14CD3~1.EXE > nul
      4⤵
      PID:2500
  - - C:\Windows\{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
      C:\Windows\{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
        
        C:\Windows\{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2572
      - C:\Windows\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
        
        C:\Windows\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7E0E~1.EXE > nul
        7⤵
        
        PID:1588
        
        C:\Windows\{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
        
        C:\Windows\{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D5A87~1.EXE > nul
        8⤵
        
        PID:1944
        
        C:\Windows\{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
        
        C:\Windows\{B67C6801-902B-4bca-849E-BD065D4620CD}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
        
        C:\Windows\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{777D4~1.EXE > nul
        10⤵
        
        PID:1312
        
        C:\Windows\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
        
        C:\Windows\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
        
        C:\Windows\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe
        
        C:\Windows\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80DFF~1.EXE > nul
        12⤵
        
        PID:2948
        
        C:\Windows\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe
        
        C:\Windows\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe
        12⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB69D~1.EXE > nul
        11⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B67C6~1.EXE > nul
        9⤵
        
        PID:2656
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7010~1.EXE > nul
        6⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81295~1.EXE > nul
        5⤵
        
        PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C4AD4~1.EXE > nul
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{14CD3BC0-87C7-4057-8A22-F06D2D29714D}.exe

Filesize
216KB

MD5
48ded0af9ebaae00d3c0af63ec4058c7

SHA1
647075698328ad1a595e97631accbf1a8a7c9438

SHA256
dc16c5684c7a5f5b3cca7567369eb802bb4c50d92f06e0b44c27506ef7b3334d

SHA512
8e79290d01db70e93797ed8fb2c886eba2311570ed39dd3dec0025fbec3bdee09f9fcf421427a9e5f46c681bcc1003bf9c1dadaa6080b84139ffa8718065968a

Download Submit
C:\Windows\{777D4FD2-4C1D-4f16-81F6-E733B22726A2}.exe

Filesize
216KB

MD5
67a7bd6493af955f35cd946a81c95dc7

SHA1
0d4c6c7e0593a94d877049a0a8fc08bcb913f76a

SHA256
f999cd837c09f39014e8388afeb2dc5877665171846aa1145a5d5d1926c648e7

SHA512
5fa30c085ff0b591f671a1a7046f52bc5be871a975dede04d1ef2e6a6a10873b9dcbe6bfcab140f9080eac4797caa3192fa76c4b762268cecf2f08114eed384d

Download Submit
C:\Windows\{80DFFB8C-1CA3-4285-A2FD-916702740EA1}.exe

Filesize
216KB

MD5
0855b7a9d09db975b9da366aa86880b6

SHA1
6f671a2dedd9e7498158506fa4481f262934d75e

SHA256
5b73282211a8c1149ba23c75003710c1c757dfbde25503a7e0a9d504ef46846c

SHA512
8275a0c63e34481f3f8b2619972ef7ff16e422cd421574a45c5b7b93f8873ad396f87040c13db4a3c01cf74b753557f8f0d465597bb05c857b1e01c513db4a94

Download Submit
C:\Windows\{81295D3E-FE4D-438c-9182-88121BDC0ADF}.exe

Filesize
216KB

MD5
5bed373c122382109636f08604ac52dc

SHA1
f24ba4a504343a6c36bc0b6477ebbb7e216a75d0

SHA256
7fe938d397f3ad48b56032d7e260f847372598d321b8b4dbd6f9ce6b870aa590

SHA512
fbec58ab62afc02f00951ab50bccef0ce0ec2986bfc496dc2798df353b05e2b34e641fb4d47da4d32877230bad168add094cfff2b623d276cd28955a6e5304d8

Download Submit
C:\Windows\{B67C6801-902B-4bca-849E-BD065D4620CD}.exe

Filesize
216KB

MD5
fb255018160aeef23ac6f078078dc61d

SHA1
7b7da0e2089ee74b7aedcc04508eefb8fd17ef64

SHA256
b61e592c132c2a8c245160ee3c81ea513455e305b23744eb6980e6785690918a

SHA512
25ed7a4e7b880fcce45d754b1cf74a5b36f7ea40837463b0da6e098ac0e704c2f3e0b2bf9e6201b2326ecce0b6813cf8149ea55fbd2e1af326315b937ed43ee3

Download Submit
C:\Windows\{C4AD4A58-D209-4d5d-A59F-12F3DC0B6ACB}.exe

Filesize
216KB

MD5
abfc5de1eff9c0e814e4f00aefe12286

SHA1
ccd38b0abc6ed40b13a2c5ffaea6476e38e0dd5b

SHA256
4a2ffeaa03af0a0e57d906788c10acf015322c69bad3144bf8e6532922667723

SHA512
d97ec6096df8f6b4a09cd3145eaa70d0c2a93505a89635c0a2c58d47d42742e50cbef12a00a54657b216bce3615ae46cca0a2d61ad0d2216b2cdaaaadc474e5f

Download Submit
C:\Windows\{CB69D188-8AFF-4b4b-ADC9-7532100D19CD}.exe

Filesize
216KB

MD5
31998b8940e4b5e4d19faffebac3cf42

SHA1
30aca14c32f8dc1ddf591abe62819d7ee3b352ad

SHA256
d9df2f478a8792dc415dec969d84a1acf098ba1cacba9ea3c269fc1164e7b6db

SHA512
190305e8b234dc457bdaf0e150579e3df11014d3df17b06eb134477b0170610ee8fc13f60e5440d19cddbd758c2637e0861872bdbc84503de4bc549b61f9f0e8

Download Submit
C:\Windows\{D5A87E6C-F41F-4afe-8987-7267795978EC}.exe

Filesize
216KB

MD5
05a2227ffc087c182877771ef3f8776f

SHA1
c9e18934a7d2cf5053f2913b2c199cf3b8b80c1e

SHA256
284b4fbd0aa332f4d500649c571e4fca3bfb9f9ea83dcd15c2fd21d1c2c2eeb9

SHA512
e0543da3ccc1c7862fb179ca53105d3cf9f49d79341840b758c2d1f7e767691aa0418687aaaab535cb6ce24c1d8d870e9f15f4bc33c18993101127870e9a4e75

Download Submit
C:\Windows\{D70108F8-DB42-46ca-90B1-7A300B23B267}.exe

Filesize
216KB

MD5
3365a44258224aaa86172fcd01e6d25d

SHA1
b1a3c3ef578ce07521eaea0f53cd6bd79403ee2a

SHA256
5a9f22831082cb7e8e2f38cc7e2dbbf2e9e318d3553278a2fcd7ece2243bc42f

SHA512
7c836d6ef25e76e04e2ee5c5d36fddeae3edf59ba1ef9a3fc7b50eaf9c407db17f36f3c483fa55657b03357f595fe4345b9c21d2aa616b8a6743fba609e50a69

Download Submit
C:\Windows\{D7E0EE01-10D7-45ff-BFAD-99A2281EFBC8}.exe

Filesize
216KB

MD5
5d327c5a1d18a3e61947283eac8602da

SHA1
8a289f42016cd5e220851d9fa377fc9435183f65

SHA256
3d9e858b1d76748b270623c619f3e95dfa0d813ac0fa867999be5f1ad580366c

SHA512
e14624e620c788b26b7d10375fa871c6656f4d5e9246a15a795c1ef64a02dece477bece525b4095395738ee3162dc164e8d079482bf7419bc529eb466fac9faa

Download Submit
C:\Windows\{E905587A-090E-47c4-B8DE-0CAE4A6635E7}.exe

Filesize
216KB

MD5
5213908ac3e55a429a3e90321cf82714

SHA1
4ddfd1b90083e56fa20ebe5901e00c6337d121d2

SHA256
732a530ae1d339ccabbb0625f74d83322dafce652a7c0df8c4d72859ebde0662

SHA512
58ff5d25233cc30f102d016aee89f48809b020c035c55e29fc90a3a359f3f13062d9cde6bd9ead71961a01f43d08b347cd8fb8e8d6f0550c8c8e237d0337e09f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads