ccfc924e49c1c1ec37335861308b0613149f962a781b5c09349ed103b89f83e1

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Size

197KB
MD5

d6bca638be27d6006bb3b2558e8a729a
SHA1

488da09abdcd0f5c389629aa18d69cb612906395
SHA256

ccfc924e49c1c1ec37335861308b0613149f962a781b5c09349ed103b89f83e1
SHA512

080d6e481f0f36ed898e6af5c33196b86d9e7c4eab8000425794f0229413c333d7f28656de1466d49fb30b6d5401803689779d5f75d907e109c8c21e87691305
SSDEEP

3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGtlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 15 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012243-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122f3-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012243-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0032000000015c80-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122f3-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0032000000015c80-20.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003300000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003400000000b1f4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000122f3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f0000000122f3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{087514A3-F786-4fa4-AA9F-147FFC54483E}\stubpath = "C:\\Windows\\{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe"	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA882947-3F12-4307-943D-8D80329D825B}\stubpath = "C:\\Windows\\{EA882947-3F12-4307-943D-8D80329D825B}.exe"	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{087514A3-F786-4fa4-AA9F-147FFC54483E}	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}\stubpath = "C:\\Windows\\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe"	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A717964B-4ACB-485b-8132-273A57BD3A46}	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A717964B-4ACB-485b-8132-273A57BD3A46}\stubpath = "C:\\Windows\\{A717964B-4ACB-485b-8132-273A57BD3A46}.exe"	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85F7F320-E2D3-48de-9C91-37D7E02397BA}	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85F7F320-E2D3-48de-9C91-37D7E02397BA}\stubpath = "C:\\Windows\\{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe"	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}\stubpath = "C:\\Windows\\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe"	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}\stubpath = "C:\\Windows\\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe"	{EA882947-3F12-4307-943D-8D80329D825B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}\stubpath = "C:\\Windows\\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe"	{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}	{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8573310F-3827-4756-A4F4-6CE5563FC7AB}	{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}	{EA882947-3F12-4307-943D-8D80329D825B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8573310F-3827-4756-A4F4-6CE5563FC7AB}\stubpath = "C:\\Windows\\{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe"	{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}\stubpath = "C:\\Windows\\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe"	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}	{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}\stubpath = "C:\\Windows\\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe"	{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA882947-3F12-4307-943D-8D80329D825B}	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe

Deletes itself 1 IoCs

pid	Process
2660	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe
636	{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
2140	{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
2828	{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
3024	{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
File created	C:\Windows\{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
File created	C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
File created	C:\Windows\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
File created	C:\Windows\{EA882947-3F12-4307-943D-8D80329D825B}.exe	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
File created	C:\Windows\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe	{EA882947-3F12-4307-943D-8D80329D825B}.exe
File created	C:\Windows\{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe	{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
File created	C:\Windows\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe	{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
File created	C:\Windows\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe	{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
File created	C:\Windows\{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
File created	C:\Windows\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
Token: SeIncBasePriorityPrivilege	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
Token: SeIncBasePriorityPrivilege	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
Token: SeIncBasePriorityPrivilege	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
Token: SeIncBasePriorityPrivilege	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
Token: SeIncBasePriorityPrivilege	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
Token: SeIncBasePriorityPrivilege	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe
Token: SeIncBasePriorityPrivilege	636	{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
Token: SeIncBasePriorityPrivilege	2140	{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
Token: SeIncBasePriorityPrivilege	2828	{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3016	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	29
PID 1944 wrote to memory of 3016	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	29
PID 1944 wrote to memory of 3016	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	29
PID 1944 wrote to memory of 3016	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	29
PID 1944 wrote to memory of 2660	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	28
PID 1944 wrote to memory of 2660	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	28
PID 1944 wrote to memory of 2660	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	28
PID 1944 wrote to memory of 2660	1944	2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe	28
PID 3016 wrote to memory of 2388	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	31
PID 3016 wrote to memory of 2388	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	31
PID 3016 wrote to memory of 2388	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	31
PID 3016 wrote to memory of 2388	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	31
PID 3016 wrote to memory of 2520	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	30
PID 3016 wrote to memory of 2520	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	30
PID 3016 wrote to memory of 2520	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	30
PID 3016 wrote to memory of 2520	3016	{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe	30
PID 2388 wrote to memory of 2580	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	35
PID 2388 wrote to memory of 2580	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	35
PID 2388 wrote to memory of 2580	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	35
PID 2388 wrote to memory of 2580	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	35
PID 2388 wrote to memory of 2968	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	34
PID 2388 wrote to memory of 2968	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	34
PID 2388 wrote to memory of 2968	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	34
PID 2388 wrote to memory of 2968	2388	{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe	34
PID 2580 wrote to memory of 1668	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	36
PID 2580 wrote to memory of 1668	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	36
PID 2580 wrote to memory of 1668	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	36
PID 2580 wrote to memory of 1668	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	36
PID 2580 wrote to memory of 524	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	37
PID 2580 wrote to memory of 524	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	37
PID 2580 wrote to memory of 524	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	37
PID 2580 wrote to memory of 524	2580	{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe	37
PID 1668 wrote to memory of 1600	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	38
PID 1668 wrote to memory of 1600	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	38
PID 1668 wrote to memory of 1600	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	38
PID 1668 wrote to memory of 1600	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	38
PID 1668 wrote to memory of 1904	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	39
PID 1668 wrote to memory of 1904	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	39
PID 1668 wrote to memory of 1904	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	39
PID 1668 wrote to memory of 1904	1668	{A717964B-4ACB-485b-8132-273A57BD3A46}.exe	39
PID 1600 wrote to memory of 1644	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	40
PID 1600 wrote to memory of 1644	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	40
PID 1600 wrote to memory of 1644	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	40
PID 1600 wrote to memory of 1644	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	40
PID 1600 wrote to memory of 1088	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	41
PID 1600 wrote to memory of 1088	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	41
PID 1600 wrote to memory of 1088	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	41
PID 1600 wrote to memory of 1088	1600	{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe	41
PID 1644 wrote to memory of 1728	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	42
PID 1644 wrote to memory of 1728	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	42
PID 1644 wrote to memory of 1728	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	42
PID 1644 wrote to memory of 1728	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	42
PID 1644 wrote to memory of 1020	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	43
PID 1644 wrote to memory of 1020	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	43
PID 1644 wrote to memory of 1020	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	43
PID 1644 wrote to memory of 1020	1644	{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe	43
PID 1728 wrote to memory of 636	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	44
PID 1728 wrote to memory of 636	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	44
PID 1728 wrote to memory of 636	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	44
PID 1728 wrote to memory of 636	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	44
PID 1728 wrote to memory of 1696	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	45
PID 1728 wrote to memory of 1696	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	45
PID 1728 wrote to memory of 1696	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	45
PID 1728 wrote to memory of 1696	1728	{EA882947-3F12-4307-943D-8D80329D825B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_d6bca638be27d6006bb3b2558e8a729a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2660
- C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
  C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BFF96~1.EXE > nul
    3⤵
    PID:2520
- - C:\Windows\{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
    C:\Windows\{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{08751~1.EXE > nul
      4⤵
      PID:2968
  - - C:\Windows\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
      C:\Windows\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
        
        C:\Windows\{A717964B-4ACB-485b-8132-273A57BD3A46}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Windows\{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
        
        C:\Windows\{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
        
        C:\Windows\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\{EA882947-3F12-4307-943D-8D80329D825B}.exe
        
        C:\Windows\{EA882947-3F12-4307-943D-8D80329D825B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
        
        C:\Windows\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
        
        C:\Windows\{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
        
        C:\Windows\{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
        
        C:\Windows\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe
        
        C:\Windows\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe
        12⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{15541~1.EXE > nul
        12⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85733~1.EXE > nul
        11⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D664C~1.EXE > nul
        10⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EA882~1.EXE > nul
        9⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D55E9~1.EXE > nul
        8⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85F7F~1.EXE > nul
        7⤵
        
        PID:1088
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A7179~1.EXE > nul
        6⤵
        
        PID:1904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8DBFC~1.EXE > nul
        5⤵
        
        PID:524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{087514A3-F786-4fa4-AA9F-147FFC54483E}.exe

Filesize
139KB

MD5
af5f1ab869b508ed27f264871181f380

SHA1
ab786861898ce72c752aea040a03ef45c6866dbf

SHA256
6a7723d1b25784736f94461a5868b9debb05617731eff46d251b5169d9fff9f6

SHA512
bcc6734a1429d98c5f0a945dff33747009c2cfc52c6c093659077154176315b1a4fb6984b44f219043a323d8aa14d0cfdb1c1311e66a0163e049d9109e98a8be

Download Submit
C:\Windows\{15541E7F-1F06-4cf6-83E5-D699E4A71F54}.exe

Filesize
197KB

MD5
403592c17ca5508b5a6b123b7f92bd91

SHA1
177e2c6cdcbf1f4afc4c90098e5a4f219a8b2fd7

SHA256
d6fd38415d68f94ec96e514008b0134a09702835ba3c47c644cac9b86ff16cef

SHA512
9acc645267bedb8d45d39a6fc9138435b942413c1d26e3a178f56758164880d10c0e6b4240937a455839672940d551348d950535f25fb05f9f7450e6b792c3c6

Download Submit
C:\Windows\{8573310F-3827-4756-A4F4-6CE5563FC7AB}.exe

Filesize
197KB

MD5
51dd24659ae6c1aac600fb4cf282b2ba

SHA1
adc223179e18a5f36f7d1ed8a504a7c46d4713d5

SHA256
7a06e03a727e16ea5dbb29c03f6a229536e01de9fb573114998272672f53263b

SHA512
24b91da429a6189614a0f3d25fb6b206d3527de035dc37c81474b50bd57b3dddbb03630e5f50e8af9202fbeaec8fb8d282dbcda7fab5bebfecb2864c4bdf3a93

Download Submit
C:\Windows\{85F7F320-E2D3-48de-9C91-37D7E02397BA}.exe

Filesize
197KB

MD5
57637e629ff8cc796e2d1be3bdbb49cf

SHA1
170001761bf39ba05c8c3edc5ba6ca3a295faf1e

SHA256
09a9279f1ab40f663a0b30789a36a8d4a8ed700114131f701460b4745ed575c6

SHA512
ec990fa50cefaafa3926228e45036795bc517599e241f0ddb209200389b68539475db21ef42725844dc8fad6b8d4b1f37a06b0fc4691148e27695bf2240e38ae

Download Submit
C:\Windows\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe

Filesize
136KB

MD5
591a5b945d602c889eee0fc972feebe8

SHA1
a98789d37873bca745cf689501b65a3d734a99ea

SHA256
ff672780b519efc1a081cb1b2eeb428a485cbf67021b370a83f2d27189105bc8

SHA512
73abdd0be8e7b5ec2dddce28d815962061dd0f7a3636ed8fbd63ba0b45723e1d30d4e8ce80300f0b75966a90789b9d469ff6c0d3750c9cf0f44b51fdf2a7436a

Download Submit
C:\Windows\{8DBFCEED-93EE-4f5a-969B-98A0CC9432F8}.exe

Filesize
197KB

MD5
16384925cb3b93cf75a792f12ec39cf3

SHA1
f58a42512e7bfe4ece3278ef2d1053a4341eb736

SHA256
bd59d56f5be7b9afdf4d4e9ea71b7c436d9ef32e94ce31c229826dea00c45cfb

SHA512
0a892ae29523bde62b190bf6468067a3d74f0ffcfb348b79ef8e45afb9b0efc03980b5c41ea2cb62d1c83ceab3952aa6068c2690bcf19cccc7574477a34299c6

Download Submit
C:\Windows\{A717964B-4ACB-485b-8132-273A57BD3A46}.exe

Filesize
197KB

MD5
0e46981214766ded47ab8edd64420226

SHA1
4294e5b182f1e129f2d8733ae984a9bb8936b142

SHA256
b7c18cfba0554116ef18dc3bd3a6c535b8ec30c0740aa68836b478d980d8283e

SHA512
fb18920b6db0b90730230c14f322c76ab0d75653801975550ddd6ce98ae0ee897d8ac9e8141c6530e25ea239e91dc5dfd7133374a77eead38c869486dde1a9e2

Download Submit
C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe

Filesize
1KB

MD5
4bc0c8a9188ba80b6b1d123f1538b01c

SHA1
f970f1d1eb981593f5dce6c92a843c45a5c93db2

SHA256
8d808b2a37d78acca7fb3cf18ce2a6c378433f6f09a1700955074eec9d0673ec

SHA512
c9ee2ff3915c0df23c16a774bcd2e4a8584e4d938b10e998e95e7095975d88c825c7d1d681916823e64f9076d739769afadff629f6aa608e4e14a41b9d5b5bd4

Download Submit
C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe

Filesize
197KB

MD5
5169561ebcf750f1b1c5f6af87b84d4b

SHA1
f3e359c71991628fdea024efdc19fc2cf05db5f2

SHA256
2f5f4032aad0a2d78748b4d030f1d3ad14245c0ce427a367f6fbfc23abbd25bf

SHA512
892a043f3872b461e01290fbd198d93a6b4d08fa0e598255aaa78250a552622617c0b0985ccdf14f1c697a6e84791a02caa0b57d02509162c72278178f632a73

Download Submit
C:\Windows\{BFF965C6-CB41-4a88-AB05-7C2A45F7E350}.exe

Filesize
53KB

MD5
c815b4b345be13fc8afdbc7cccb253c1

SHA1
6ef6843164f407583e75d0991c6bb7f3cf5d1aec

SHA256
29a96be32097a7a7774c777d2bd03bea217b789f34ee84d62a91a367da70a123

SHA512
f47f806da35413fdc2f31dd731f195b9444b30ea68a1c8a10b27b8a12d36c5dfbca2d8943bb843bb5a9578a34019a93d281cdf4d87e8e171a0e789ea7a8b9a26

Download Submit
C:\Windows\{D55E92A7-CE90-4ff8-820B-92F9A3023B55}.exe

Filesize
197KB

MD5
b01a9c1cb4771d67e4133f139019f29e

SHA1
4a6485e7e994725ec1aea6769823fe58e9fc6e71

SHA256
b15849aec38f5e7eb6570975c93e7190f6f84145d28f1ada96ab834d5fa93649

SHA512
600e1b6beda0d6ec1134b897bc906028eeb5de062474608231e6e51b757c9ced609a12cf1086ce61fb0a074bc893bbbd9a3a3c0d77e3091cd3fde97be25becdf

Download Submit
C:\Windows\{D664C51E-DDC4-4fbf-9A24-84DB7DB228AB}.exe

Filesize
197KB

MD5
53d793476a3fa6a0b9e6c9824d8509b0

SHA1
cf5819474b86995af29549807906ad12547af84a

SHA256
4a6b30ff56e7df3a76b915c535b2b565382bedae058379c24f27d36b309807fb

SHA512
e5d89d9fb345c84af8fd7feef5af783f696161419911a7f7782c330a7443a2dee94b135a7f1f52284fd135b58d3ed18982da30f940be9fd4e3950676a403f32f

Download Submit
C:\Windows\{E6AAAC36-8922-4c93-ADB6-A1C50D286212}.exe

Filesize
197KB

MD5
1e90c824ee4f680541c1fe629faecfbd

SHA1
431df92d93e24da2afc5ae707c393065bfce97c3

SHA256
2a20643e5712e51def537b5fdeb34cac2c1861de32d1203fc0abdb164f06a05d

SHA512
10346b8b53226916dfcdeee858da8620052de8dce62e6f81099e7a47e03b1c3b7d6e3c0745fc9182cd19ac41ae1803b4ff56774e740a027d265d9d3a9764e489

Download Submit
C:\Windows\{EA882947-3F12-4307-943D-8D80329D825B}.exe

Filesize
197KB

MD5
5d9460e06ed23c6d00e8ee889e29dc3a

SHA1
fb35fb47615832e884a61f12a2faa4c0a297203f

SHA256
a3f95b21ff721dd58ed416ad76b13f0ced189fb281a8e2245707f0504abbbd3b

SHA512
1c30960f54aa4992256103f49a23426c858f72e5adc9a458169d21a8449d4cd3b3c24fa98821b8cf1bba7cbcd820183595ec98749676051f3150f6d241292796

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads