9be09e02b7ef3931d0cd471c24f3a25b528bae1bc8f73fd21d01f560a1029340

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
Size

372KB
MD5

845f140f50aa287ccafc09fffe2991fd
SHA1

ef2ddfb7dec6d90168224a4a20f88a955c338611
SHA256

9be09e02b7ef3931d0cd471c24f3a25b528bae1bc8f73fd21d01f560a1029340
SHA512

a188c2e8c422a24d255ccf8786c1d14efe63125536388d5bbf4acd48a209e154122e82503e365d41ec6ed7390e7a27939fe7b9cd5b6108e82af56f04e7dcb1fe
SSDEEP

3072:CEGh0oWmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGJl/Oe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014826-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014ac0-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014826-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000001560b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a5a-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014826-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a5a-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014826-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a5a-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014826-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014826-69.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a5a-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}	{48823D5F-C507-44df-8121-E2D01375259F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CCF1D67-6157-4f60-B447-23F9F7A28899}\stubpath = "C:\\Windows\\{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe"	{02D23110-4258-4c0a-AB29-18838556B604}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}\stubpath = "C:\\Windows\\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe"	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D30D1F5E-24FE-491a-B717-EBA3541378E5}\stubpath = "C:\\Windows\\{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe"	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48823D5F-C507-44df-8121-E2D01375259F}	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}\stubpath = "C:\\Windows\\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe"	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F067162-8CD9-4571-A39F-670F428D3CB9}	{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}	{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}\stubpath = "C:\\Windows\\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe"	{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}\stubpath = "C:\\Windows\\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe"	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48823D5F-C507-44df-8121-E2D01375259F}\stubpath = "C:\\Windows\\{48823D5F-C507-44df-8121-E2D01375259F}.exe"	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}\stubpath = "C:\\Windows\\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe"	{48823D5F-C507-44df-8121-E2D01375259F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02D23110-4258-4c0a-AB29-18838556B604}	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02D23110-4258-4c0a-AB29-18838556B604}\stubpath = "C:\\Windows\\{02D23110-4258-4c0a-AB29-18838556B604}.exe"	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CCF1D67-6157-4f60-B447-23F9F7A28899}	{02D23110-4258-4c0a-AB29-18838556B604}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6F067162-8CD9-4571-A39F-670F428D3CB9}\stubpath = "C:\\Windows\\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe"	{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D30D1F5E-24FE-491a-B717-EBA3541378E5}	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}\stubpath = "C:\\Windows\\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe"	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe

Deletes itself 1 IoCs

pid	Process
2680	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe
2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
320	{02D23110-4258-4c0a-AB29-18838556B604}.exe
2104	{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
592	{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
2864	{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
File created	C:\Windows\{48823D5F-C507-44df-8121-E2D01375259F}.exe	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
File created	C:\Windows\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
File created	C:\Windows\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe	{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
File created	C:\Windows\{02D23110-4258-4c0a-AB29-18838556B604}.exe	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
File created	C:\Windows\{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe	{02D23110-4258-4c0a-AB29-18838556B604}.exe
File created	C:\Windows\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe	{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
File created	C:\Windows\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
File created	C:\Windows\{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
File created	C:\Windows\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	{48823D5F-C507-44df-8121-E2D01375259F}.exe
File created	C:\Windows\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
Token: SeIncBasePriorityPrivilege	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
Token: SeIncBasePriorityPrivilege	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
Token: SeIncBasePriorityPrivilege	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe
Token: SeIncBasePriorityPrivilege	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
Token: SeIncBasePriorityPrivilege	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
Token: SeIncBasePriorityPrivilege	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
Token: SeIncBasePriorityPrivilege	320	{02D23110-4258-4c0a-AB29-18838556B604}.exe
Token: SeIncBasePriorityPrivilege	2104	{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
Token: SeIncBasePriorityPrivilege	592	{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2520	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	28
PID 2020 wrote to memory of 2520	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	28
PID 2020 wrote to memory of 2520	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	28
PID 2020 wrote to memory of 2520	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	28
PID 2020 wrote to memory of 2680	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	29
PID 2020 wrote to memory of 2680	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	29
PID 2020 wrote to memory of 2680	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	29
PID 2020 wrote to memory of 2680	2020	2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe	29
PID 2520 wrote to memory of 2640	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	30
PID 2520 wrote to memory of 2640	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	30
PID 2520 wrote to memory of 2640	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	30
PID 2520 wrote to memory of 2640	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	30
PID 2520 wrote to memory of 2860	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	31
PID 2520 wrote to memory of 2860	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	31
PID 2520 wrote to memory of 2860	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	31
PID 2520 wrote to memory of 2860	2520	{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe	31
PID 2640 wrote to memory of 2260	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	32
PID 2640 wrote to memory of 2260	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	32
PID 2640 wrote to memory of 2260	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	32
PID 2640 wrote to memory of 2260	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	32
PID 2640 wrote to memory of 2692	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	33
PID 2640 wrote to memory of 2692	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	33
PID 2640 wrote to memory of 2692	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	33
PID 2640 wrote to memory of 2692	2640	{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe	33
PID 2260 wrote to memory of 2960	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	37
PID 2260 wrote to memory of 2960	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	37
PID 2260 wrote to memory of 2960	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	37
PID 2260 wrote to memory of 2960	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	37
PID 2260 wrote to memory of 2136	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	36
PID 2260 wrote to memory of 2136	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	36
PID 2260 wrote to memory of 2136	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	36
PID 2260 wrote to memory of 2136	2260	{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe	36
PID 2960 wrote to memory of 2752	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	38
PID 2960 wrote to memory of 2752	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	38
PID 2960 wrote to memory of 2752	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	38
PID 2960 wrote to memory of 2752	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	38
PID 2960 wrote to memory of 956	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	39
PID 2960 wrote to memory of 956	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	39
PID 2960 wrote to memory of 956	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	39
PID 2960 wrote to memory of 956	2960	{48823D5F-C507-44df-8121-E2D01375259F}.exe	39
PID 2752 wrote to memory of 1168	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	40
PID 2752 wrote to memory of 1168	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	40
PID 2752 wrote to memory of 1168	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	40
PID 2752 wrote to memory of 1168	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	40
PID 2752 wrote to memory of 1792	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	41
PID 2752 wrote to memory of 1792	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	41
PID 2752 wrote to memory of 1792	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	41
PID 2752 wrote to memory of 1792	2752	{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe	41
PID 1168 wrote to memory of 2824	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	42
PID 1168 wrote to memory of 2824	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	42
PID 1168 wrote to memory of 2824	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	42
PID 1168 wrote to memory of 2824	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	42
PID 1168 wrote to memory of 2796	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	43
PID 1168 wrote to memory of 2796	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	43
PID 1168 wrote to memory of 2796	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	43
PID 1168 wrote to memory of 2796	1168	{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe	43
PID 2824 wrote to memory of 320	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	45
PID 2824 wrote to memory of 320	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	45
PID 2824 wrote to memory of 320	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	45
PID 2824 wrote to memory of 320	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	45
PID 2824 wrote to memory of 2976	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	44
PID 2824 wrote to memory of 2976	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	44
PID 2824 wrote to memory of 2976	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	44
PID 2824 wrote to memory of 2976	2824	{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_845f140f50aa287ccafc09fffe2991fd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
  C:\Windows\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
    C:\Windows\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
      C:\Windows\{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D30D1~1.EXE > nul
        5⤵
        
        PID:2136
    - - C:\Windows\{48823D5F-C507-44df-8121-E2D01375259F}.exe
        
        C:\Windows\{48823D5F-C507-44df-8121-E2D01375259F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2960
      - C:\Windows\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
        
        C:\Windows\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
        
        C:\Windows\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
        
        C:\Windows\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E8E8~1.EXE > nul
        9⤵
        
        PID:2976
        
        C:\Windows\{02D23110-4258-4c0a-AB29-18838556B604}.exe
        
        C:\Windows\{02D23110-4258-4c0a-AB29-18838556B604}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02D23~1.EXE > nul
        10⤵
        
        PID:1964
        
        C:\Windows\{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
        
        C:\Windows\{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1CCF1~1.EXE > nul
        11⤵
        
        PID:488
        
        C:\Windows\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
        
        C:\Windows\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
        
        C:\Windows\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe
        
        C:\Windows\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe
        12⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6F067~1.EXE > nul
        12⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B2DE~1.EXE > nul
        8⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C21AD~1.EXE > nul
        7⤵
        
        PID:1792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48823~1.EXE > nul
        6⤵
        
        PID:956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DEC8C~1.EXE > nul
      4⤵
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D9D71~1.EXE > nul
    3⤵
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02D23110-4258-4c0a-AB29-18838556B604}.exe

Filesize
372KB

MD5
ff7134f9a1f1ce1f64f60354a2cbd47d

SHA1
033e79212543bca4525ae0516ef83ddd8acdce56

SHA256
d714e04d6958313f558e4da164c0c48c90655c8193095b56734a14457e808eb2

SHA512
89a4ec8ddc49ad4ea881de4b080cca918189e40e3626025d6f6cc4595fbcd2f93d32e9351ad1900360a18ad0149dec17ff21de683469a5e9736c3c063728fe27

Download Submit
C:\Windows\{1B2DEC33-F7A3-487c-B4E4-970C68EB0D51}.exe

Filesize
372KB

MD5
c1aa3ebf2413713c20647d5d566e5733

SHA1
ac7726c3ce02ca4ece44fb028fedaf2ea617dd19

SHA256
9f625133a0c926a15dcdbb49aecd9af6f5eebaddb33ab0d6f0f9cee9f43f69b6

SHA512
de2d983a7f065e4eaaf5ccd49ba7dd7899a7d3f5455deafce9232f44dc9f2fbe13ae9ebbced5a7ab9573bd4bb200e9cada2dcdd19ed7d25db24751caafab1e7f

Download Submit
C:\Windows\{1CCF1D67-6157-4f60-B447-23F9F7A28899}.exe

Filesize
372KB

MD5
a123ae9e4e6cbc2a7d7fe4e1ea396c93

SHA1
67e3eeddccc16a536a451149d6d5e6a2e9f935eb

SHA256
6333fe9b6c4727216330c8e430b51af863cfbdb551e8f2638b06f7ab71911d18

SHA512
33de717e667338c783283ce907961a9cb5badcfa79e9633222a7d294e27fe1de1cb597152893ed262ed9017b953f4a34ef4dfc2f30962d9093f32ff2789d3f01

Download Submit
C:\Windows\{48823D5F-C507-44df-8121-E2D01375259F}.exe

Filesize
372KB

MD5
9b992bba284feb3fe078d3801d88d4e7

SHA1
82b611949d6ea5de0c2c83b1425acbf55955e4cb

SHA256
6d031f02203b280d44d03ca81787c2da3778bfec658695712eb5ba7cd8a9d1e1

SHA512
dc29556fcc286365b3b06572beb11d70ea081e384e9255beba5f2ba9aaccfd61ba43e796c3bf070afd5c7329cfda4e5fc02846d49c889b612a7697cf07fa0502

Download Submit
C:\Windows\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe

Filesize
372KB

MD5
7ff3599882653114327e06e9320be51e

SHA1
917309ee838e576f0e4952dd352b64a563a6e274

SHA256
c81719dc3a0432f280a3f1ce930fb05e5d6a9712eebe9b5e5730c80de34cb37c

SHA512
180461b24dbf271a80f4d592144d376b895f7f86857fd88312297df828ff159fd845b559716d09ef293233695ff5705bc7a25341c21f1bc914cf5afb240f2a3f

Download Submit
C:\Windows\{6F067162-8CD9-4571-A39F-670F428D3CB9}.exe

Filesize
4KB

MD5
7ebe33c1be64967c78cd552e9a24af19

SHA1
d70f54d0532329446ade324bd0c604dd0252d96a

SHA256
76bc385ed634f46681bb0879a3fca945618518434a1c23356359d16eb6803039

SHA512
be7edd4763c92b76da1af1edb822d39dc9a08d3cc20ef635518ad14d6072301011bcdac5fea8dbd029875e6b23ab52e2a88cd3ede86103ed568c2267ca1be5de

Download Submit
C:\Windows\{7E8E86DD-860B-4acc-A99C-E299D4B9A4E8}.exe

Filesize
372KB

MD5
b5dd11daa4ee30a9519e588b15afecba

SHA1
dd7e5e12ec3de72c62d020dacf7b7537b15eb8b8

SHA256
157704e080dec3c5107d3560b71bb325e5c7b3176d74d60142a9436a9e7bf856

SHA512
6c6a0c07513a66cba4db5dc805e8a7767c4ba02afbecb6e0927c0c20f4a61a0719e5761fbee4985561cbdccc8a5121a688687623e1228f97afa6722a210f55cb

Download Submit
C:\Windows\{C21AD6E3-7DCD-4fa2-BB49-EF7249BE792C}.exe

Filesize
372KB

MD5
3f2a006a9c84d71df8e126a61627587d

SHA1
34ec4c0abcb8fc607db76f573648835fdc90c6f6

SHA256
12c876a584b24851607e8c619eb0dad001d283b168caeaee70b55405b95fe6f8

SHA512
235f8387f9355a6249b4d01041d97458fa24c2b781eb4f8569ba89dfb49d9ed217c90360b0f8d5f7cb962c253e8671c56a68a6d315fb6a9ffa329689fea05e5c

Download Submit
C:\Windows\{D30D1F5E-24FE-491a-B717-EBA3541378E5}.exe

Filesize
372KB

MD5
6b042e37c8b1f938165023200ce5c811

SHA1
65a2ff3a16372609f4f54618deacf8be054a368d

SHA256
e2b279572c593922d722988799cacba22702f3049355a9acf689e6b1f27b3355

SHA512
d89ace3854412879844087987bebf24c4c61c9cbb7f00e9ca93a3bc8c6bfa49079edf81a69db903862336e3f7bd33f36f63872dcad4d85a3467287b82b5489f5

Download Submit
C:\Windows\{D3B3210A-6C90-45c6-840E-5E8BE370F98D}.exe

Filesize
372KB

MD5
7a334ed163000a0baa727aeba039142e

SHA1
f25bb61297a75c06a779651236d8bd92d8628395

SHA256
a82ebd6cb6451c4f3db86a991bbb6750c85d085280550bbd31126a0bbe395a4e

SHA512
f9a385fc319ab88ab89af2596477fea51d85536ae2f297be70abc9cc872bc6c4d7b26515897e27af1034ea6c0cd1bc446af2abf710f6598b1e5e8dbe6b050606

Download Submit
C:\Windows\{D9D71D74-89D5-4eea-8DA7-DA51618DEBD2}.exe

Filesize
372KB

MD5
8eebb6403733278cc5483552d6cdb3a1

SHA1
4f5eb304bfe16f228d0274b759adeda2d0d2388c

SHA256
417403fd47fe78ac1346219c506b2853aabedd119befd3441df220166a96e687

SHA512
a1b217b4c184d30e30376a2899308fd4f9c0d4c8f77e925a65e1fff69a7d444b9298869bc75452f476a4c93d08bbdb5a4a05774f1466046a3bae091ea9efc15b

Download Submit
C:\Windows\{DEC8CBBC-B95B-40f1-81DE-C855ED458F60}.exe

Filesize
372KB

MD5
1fde243bf0982865038b7a752aa0543f

SHA1
c6dff3adb969ce7e9702e747bd7f64d3c875256b

SHA256
b9e39dd0b905fba56bbb76f8894c16b621d648cb1cdbff4f49b17ad6778d8c51

SHA512
e2177e64f5d3dd9cf79802460c88256803a8c664791d473d94ce0cba518553718ff1c4c51dffbf0d7d42969f6e6fb4b286b24b7c4248b1c4226109d5631e441a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads