05e11945edd1cd745c5772ab50288fbf34ccf696c5a3bf927e6132370d4d1c92

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
Size

180KB
MD5

3bd883a76624714dee9486c354149228
SHA1

327d598f506014ab15c84b2d257be584ea8f4b09
SHA256

05e11945edd1cd745c5772ab50288fbf34ccf696c5a3bf927e6132370d4d1c92
SHA512

21a086d3c5270e2ba5fd93614ad7e11c28165966292b1022f5a3b380bc3770b8418771562ee7d7501f25307f6a49c2dd30aa7f6f959d33ce2a597e205fd8c6ee
SSDEEP

3072:jEGh0o4lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGal5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012306-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001315b-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012306-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003900000001340c-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012306-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012306-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012306-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012306-69.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BA16515-3D77-495e-9F11-7FF14191DACA}\stubpath = "C:\\Windows\\{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe"	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{650AA8C5-E679-461d-B8A9-909647654941}\stubpath = "C:\\Windows\\{650AA8C5-E679-461d-B8A9-909647654941}.exe"	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDC902DE-355A-4102-96C2-47F20936E31F}	{650AA8C5-E679-461d-B8A9-909647654941}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{830FC602-3B50-45b9-8D3B-9043E45079E9}\stubpath = "C:\\Windows\\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe"	{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1923DE66-0D39-45eb-BE87-611F62050DC0}	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{650AA8C5-E679-461d-B8A9-909647654941}	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}	{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BA16515-3D77-495e-9F11-7FF14191DACA}	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}\stubpath = "C:\\Windows\\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe"	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D0E79D9-FAAD-4941-8935-F734BCB88168}	{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D0E79D9-FAAD-4941-8935-F734BCB88168}\stubpath = "C:\\Windows\\{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe"	{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}\stubpath = "C:\\Windows\\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe"	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}\stubpath = "C:\\Windows\\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe"	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1923DE66-0D39-45eb-BE87-611F62050DC0}\stubpath = "C:\\Windows\\{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe"	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}\stubpath = "C:\\Windows\\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe"	{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{830FC602-3B50-45b9-8D3B-9043E45079E9}	{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}\stubpath = "C:\\Windows\\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe"	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDC902DE-355A-4102-96C2-47F20936E31F}\stubpath = "C:\\Windows\\{FDC902DE-355A-4102-96C2-47F20936E31F}.exe"	{650AA8C5-E679-461d-B8A9-909647654941}.exe

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe
2020	{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
2168	{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
768	{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
1260	{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
File created	C:\Windows\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
File created	C:\Windows\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
File created	C:\Windows\{650AA8C5-E679-461d-B8A9-909647654941}.exe	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
File created	C:\Windows\{FDC902DE-355A-4102-96C2-47F20936E31F}.exe	{650AA8C5-E679-461d-B8A9-909647654941}.exe
File created	C:\Windows\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe	{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
File created	C:\Windows\{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe	{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
File created	C:\Windows\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
File created	C:\Windows\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
File created	C:\Windows\{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
File created	C:\Windows\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe	{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
Token: SeIncBasePriorityPrivilege	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
Token: SeIncBasePriorityPrivilege	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
Token: SeIncBasePriorityPrivilege	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
Token: SeIncBasePriorityPrivilege	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
Token: SeIncBasePriorityPrivilege	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
Token: SeIncBasePriorityPrivilege	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe
Token: SeIncBasePriorityPrivilege	2020	{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
Token: SeIncBasePriorityPrivilege	2168	{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
Token: SeIncBasePriorityPrivilege	768	{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2216	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	28
PID 2720 wrote to memory of 2216	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	28
PID 2720 wrote to memory of 2216	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	28
PID 2720 wrote to memory of 2216	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	28
PID 2720 wrote to memory of 2580	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	29
PID 2720 wrote to memory of 2580	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	29
PID 2720 wrote to memory of 2580	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	29
PID 2720 wrote to memory of 2580	2720	2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe	29
PID 2216 wrote to memory of 2540	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	30
PID 2216 wrote to memory of 2540	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	30
PID 2216 wrote to memory of 2540	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	30
PID 2216 wrote to memory of 2540	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	30
PID 2216 wrote to memory of 2640	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	31
PID 2216 wrote to memory of 2640	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	31
PID 2216 wrote to memory of 2640	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	31
PID 2216 wrote to memory of 2640	2216	{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe	31
PID 2540 wrote to memory of 2304	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	32
PID 2540 wrote to memory of 2304	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	32
PID 2540 wrote to memory of 2304	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	32
PID 2540 wrote to memory of 2304	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	32
PID 2540 wrote to memory of 2380	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	33
PID 2540 wrote to memory of 2380	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	33
PID 2540 wrote to memory of 2380	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	33
PID 2540 wrote to memory of 2380	2540	{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe	33
PID 2304 wrote to memory of 1128	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	36
PID 2304 wrote to memory of 1128	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	36
PID 2304 wrote to memory of 1128	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	36
PID 2304 wrote to memory of 1128	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	36
PID 2304 wrote to memory of 1032	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	37
PID 2304 wrote to memory of 1032	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	37
PID 2304 wrote to memory of 1032	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	37
PID 2304 wrote to memory of 1032	2304	{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe	37
PID 1128 wrote to memory of 1540	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	38
PID 1128 wrote to memory of 1540	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	38
PID 1128 wrote to memory of 1540	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	38
PID 1128 wrote to memory of 1540	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	38
PID 1128 wrote to memory of 1604	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	39
PID 1128 wrote to memory of 1604	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	39
PID 1128 wrote to memory of 1604	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	39
PID 1128 wrote to memory of 1604	1128	{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe	39
PID 1540 wrote to memory of 1992	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	40
PID 1540 wrote to memory of 1992	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	40
PID 1540 wrote to memory of 1992	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	40
PID 1540 wrote to memory of 1992	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	40
PID 1540 wrote to memory of 2344	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	41
PID 1540 wrote to memory of 2344	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	41
PID 1540 wrote to memory of 2344	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	41
PID 1540 wrote to memory of 2344	1540	{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe	41
PID 1992 wrote to memory of 1640	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	42
PID 1992 wrote to memory of 1640	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	42
PID 1992 wrote to memory of 1640	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	42
PID 1992 wrote to memory of 1640	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	42
PID 1992 wrote to memory of 1568	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	43
PID 1992 wrote to memory of 1568	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	43
PID 1992 wrote to memory of 1568	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	43
PID 1992 wrote to memory of 1568	1992	{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe	43
PID 1640 wrote to memory of 2020	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	44
PID 1640 wrote to memory of 2020	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	44
PID 1640 wrote to memory of 2020	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	44
PID 1640 wrote to memory of 2020	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	44
PID 1640 wrote to memory of 2944	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	45
PID 1640 wrote to memory of 2944	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	45
PID 1640 wrote to memory of 2944	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	45
PID 1640 wrote to memory of 2944	1640	{650AA8C5-E679-461d-B8A9-909647654941}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_3bd883a76624714dee9486c354149228_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
  C:\Windows\{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
    C:\Windows\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
      C:\Windows\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Windows\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
        
        C:\Windows\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
        
        C:\Windows\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
        
        C:\Windows\{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\{650AA8C5-E679-461d-B8A9-909647654941}.exe
        
        C:\Windows\{650AA8C5-E679-461d-B8A9-909647654941}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
        
        C:\Windows\{FDC902DE-355A-4102-96C2-47F20936E31F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
        
        C:\Windows\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
        
        C:\Windows\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
        
        C:\Windows\{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe
        
        C:\Windows\{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe
        12⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{830FC~1.EXE > nul
        12⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CDDE~1.EXE > nul
        11⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FDC90~1.EXE > nul
        10⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{650AA~1.EXE > nul
        9⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1923D~1.EXE > nul
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9660E~1.EXE > nul
        7⤵
        
        PID:2344
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE4F3~1.EXE > nul
        6⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F7335~1.EXE > nul
        5⤵
        
        PID:1032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8D8C1~1.EXE > nul
      4⤵
      PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1BA16~1.EXE > nul
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0D0E79D9-FAAD-4941-8935-F734BCB88168}.exe

Filesize
180KB

MD5
99391e409eea92feb6145e7302f387ef

SHA1
7034776dab42315ce753d2d035a1efb0cd60963e

SHA256
38f4905ba62f88bcbb1f9cc556b4e301c22f6a980a3876669b052f0e6e093ead

SHA512
bf00e15d092079a6735ce6dc88424286e4091f135025e39afb01adf1c53619d549758c1e35f883b27c54e45b407e5780061fc8a6b04437d8c37be9545e96eaa4

Download Submit
C:\Windows\{1923DE66-0D39-45eb-BE87-611F62050DC0}.exe

Filesize
180KB

MD5
f4b8d9b1f4d547024c9076eba2114965

SHA1
7137218c78d0dbac87bfef47a2417ac5f99f0ccf

SHA256
09565def65f9d5cd08cfa2b547ff2dcd8e4d649f97ef6483478a5c7a69c9c2fb

SHA512
0d501cfe76d87888ef217c8385117e5f70210e9052966b858a954490cf14a11ed3940624cd60bbb0a3b618ae17c3277a1b222c21b92197295f1f7ca7be76c388

Download Submit
C:\Windows\{1BA16515-3D77-495e-9F11-7FF14191DACA}.exe

Filesize
180KB

MD5
610e408b356de973796c6fe22f5876cc

SHA1
c7f17241c9df403382a586bc7151347a0c399523

SHA256
8778d860c90251a78c6baae7302df0c40377e5bb739e02abf1092d652613d3e1

SHA512
3166291a02f109f4f18c4532b2db787f8f67d7921b63aa3dad362d93f3bbde85552b12b3939d66eee37bfd23fe36f932e6f2c3c2a1d32a19afcf834f4150ca7e

Download Submit
C:\Windows\{650AA8C5-E679-461d-B8A9-909647654941}.exe

Filesize
180KB

MD5
d0f24035a4f6ad5f4902764c80872c3f

SHA1
dcfe5c1c3a9265ffe66bec21c915fd966ab6adcc

SHA256
6a18a095148177471fd63f16ce1f8f801cd7adb1df38433b600d7cd3ac35fe71

SHA512
311b399ec5c3ea0a34939918398b774b778200470d50080b2f112f8e88508bf65edddf203bb44049ba5f7220daa0aaaafb6ac5cf469485edbc810f008cb64113

Download Submit
C:\Windows\{7CDDE1BA-AA74-40ba-BE1F-F085327DEED3}.exe

Filesize
180KB

MD5
ab49e32c246cb0cbec74165ee2914c45

SHA1
58f46c376b506369c8b95b3a7761bddbcf5a8656

SHA256
d218b930cf9a21e5dac204c5308740482fc6e93f8f369b4f3362cbf78cdbbb28

SHA512
cefc41af99d7e6e32077452b1b0ba7c41bf15669b277c570d738aef6598b12e509c459f47fcad99f7638c79c5cde6439aa80f3ca309ad08d3e57a7ee6f22a831

Download Submit
C:\Windows\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe

Filesize
180KB

MD5
dae11712b2c30a16b82759c2c09b48eb

SHA1
4844ea557fb41dd98fe551519c27e474296b5fac

SHA256
d0e0b5914f995c0b299c3a5a801a2796caf25b659cfe372b1fa5affb2c677b6b

SHA512
5af389227e8195dce4e025bc1a2a0d2eb954aa61045645723ef14a0dc634d6ba7540df1034e330756ec3294159d939afe4fd1bed82b5ff7607762ffde6ccf4b2

Download Submit
C:\Windows\{830FC602-3B50-45b9-8D3B-9043E45079E9}.exe

Filesize
2KB

MD5
a2a093be4e86e81bb30ab9b5aa8e7a79

SHA1
28702f726560335282b42043b7e09a6d41574ad5

SHA256
85d55df484838bdf7b8fc4290b1c79135e06a6ede88978d502383e7ad185ab3c

SHA512
40a346be2e22d3a7885911064fc1d806f1009d98978fa5ec960b3b96afa52195be2b9384c121af40209bc4da699d4773149bfbf9c96cb20adc8226e03977f12d

Download Submit
C:\Windows\{8D8C1257-CF6A-4b51-9E09-9CF98188E7D1}.exe

Filesize
180KB

MD5
3c90a93f3e51905b81d791d672c0728b

SHA1
a237f69a79a50146e8f1a47652f411fc467c6eea

SHA256
09ac3ea82f11322144f13412531760172228cf3bcfaf53a552c7fcf5d566b8b0

SHA512
a8c610e592b53316859d44d3703b0efff852cd95dbb11220b0d5f7e11a5994c66323622324bd30889d89b715524ca1b509b4d71dc3d0d007c072fcd40ff53b5d

Download Submit
C:\Windows\{9660EAFF-77F9-4131-B62E-CB2F777FF7A6}.exe

Filesize
180KB

MD5
11d260ab052827a520831b6cca18feb6

SHA1
f11cbf6c8ab7b7790db30377261a22dbf5fb1cd3

SHA256
762acb960b775fac056bf94bab3ee26d507c8e8c6052278c6d3367f0e226a18e

SHA512
6b7527b59351d8130d814581b90a64d4946f5fb59c2b53e086334896003758cdf880e32b1e45f8c1db628b9e5d01caedb590b21a15d97214c11af990977a56bb

Download Submit
C:\Windows\{CE4F3CAF-9E41-482f-AFCD-8B253CBCD4D7}.exe

Filesize
180KB

MD5
7c6e75b2372fe8fdf644eeb582d3fc6a

SHA1
6aaf699e60156188dfd656ef88ca3836b4f7c067

SHA256
3873606dd422ed7336e24de24405d30fb48c0d80a25c4f18434c2f1d75b7339f

SHA512
11a1b690f5565923b5555e9b3e583fb839e064c3e873211bec68a0e78765af0b8f77eae062be83e42242e6424fe523e49b8908840e7d916c8915452ca870e8d4

Download Submit
C:\Windows\{F73350B1-D847-4fd6-9DC8-D346A699A4FC}.exe

Filesize
180KB

MD5
4b1017715a2959342b8caca8ab280e39

SHA1
e689107bb2f5181bea61819776e12edcc74224e5

SHA256
3dc4617b935838a516b62741f9e790c55fa58826ccb74a7e78e1643bed06ebe0

SHA512
1f1dfb221914d1848acb8873d0af65d3aadd455f6d51c4e8e281e22ba8e37cb66696fa8ec0ec25d158266745a9daca82e13723773fafe87c45d464cadb0b3640

Download Submit
C:\Windows\{FDC902DE-355A-4102-96C2-47F20936E31F}.exe

Filesize
180KB

MD5
57b15bb900389f6b2ef2089bb7e19ccc

SHA1
4690920620a7a43b202ee3d25d8cf625840eba1b

SHA256
f1d6739f3ded657fbb42ad4863a3e0a7d4e86d4b2a16c7a391cec9af71c091b3

SHA512
c8b5653451c381d6f0989d10776866e8a1d1bf438ecfe5a5261c8f38bc2b2642e3140174d755f46b3ef8ffc782af335eacabe98431ce27fa7a8a833acbaec938

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads