689dbb07a8a99fe712c973c3aa61b3be4b2dc7a8c7236c797b88da9ae6fd115b

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
Size

180KB
MD5

068ce879b0ff9b560bec4a3669ac9456
SHA1

76220103d1cd75c342d0d8cc11bc7d2b9e188adf
SHA256

689dbb07a8a99fe712c973c3aa61b3be4b2dc7a8c7236c797b88da9ae6fd115b
SHA512

e4b28bbc0bd2dbaca8209b7887ec442f4b610b76318d24b0130769ace75fd536bb5b64d5c3c0a3718ff788a5f9420d1d83d42e575c963de44db65dc1325b7735
SSDEEP

3072:jEGh0oilfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG0l5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012683-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0032000000015e09-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6f8-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000f6f8-20.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000015e09-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000f6f8-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0034000000015e09-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000000f6f8-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0035000000015e09-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f8-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015e09-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f8-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0791E8B1-3274-4c37-BE36-4B83331C95A5}\stubpath = "C:\\Windows\\{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe"	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5482956A-C604-4008-A1F4-A59ED6130ECA}\stubpath = "C:\\Windows\\{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe"	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48DEDCB8-2A04-499e-8EAB-18843A91578A}	{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}\stubpath = "C:\\Windows\\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe"	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5482956A-C604-4008-A1F4-A59ED6130ECA}	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}\stubpath = "C:\\Windows\\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe"	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}\stubpath = "C:\\Windows\\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe"	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}\stubpath = "C:\\Windows\\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe"	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0791E8B1-3274-4c37-BE36-4B83331C95A5}	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3E6C466-A7CB-4ac6-BE63-647452B71670}	{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809A17B6-8680-4f28-BCBD-7725BB027633}\stubpath = "C:\\Windows\\{809A17B6-8680-4f28-BCBD-7725BB027633}.exe"	{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{809A17B6-8680-4f28-BCBD-7725BB027633}	{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}\stubpath = "C:\\Windows\\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe"	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}\stubpath = "C:\\Windows\\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe"	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B3E6C466-A7CB-4ac6-BE63-647452B71670}\stubpath = "C:\\Windows\\{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe"	{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48DEDCB8-2A04-499e-8EAB-18843A91578A}\stubpath = "C:\\Windows\\{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe"	{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe

Deletes itself 1 IoCs

pid	Process
2852	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
2880	{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
1616	{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
2324	{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe
2420	{809A17B6-8680-4f28-BCBD-7725BB027633}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
File created	C:\Windows\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
File created	C:\Windows\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
File created	C:\Windows\{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
File created	C:\Windows\{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe	{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
File created	C:\Windows\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
File created	C:\Windows\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
File created	C:\Windows\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
File created	C:\Windows\{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
File created	C:\Windows\{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe	{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
File created	C:\Windows\{809A17B6-8680-4f28-BCBD-7725BB027633}.exe	{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
Token: SeIncBasePriorityPrivilege	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
Token: SeIncBasePriorityPrivilege	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
Token: SeIncBasePriorityPrivilege	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
Token: SeIncBasePriorityPrivilege	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
Token: SeIncBasePriorityPrivilege	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
Token: SeIncBasePriorityPrivilege	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
Token: SeIncBasePriorityPrivilege	2880	{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
Token: SeIncBasePriorityPrivilege	1616	{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
Token: SeIncBasePriorityPrivilege	2324	{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2804	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	28
PID 2780 wrote to memory of 2804	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	28
PID 2780 wrote to memory of 2804	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	28
PID 2780 wrote to memory of 2804	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	28
PID 2780 wrote to memory of 2852	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	29
PID 2780 wrote to memory of 2852	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	29
PID 2780 wrote to memory of 2852	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	29
PID 2780 wrote to memory of 2852	2780	2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe	29
PID 2804 wrote to memory of 2792	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	30
PID 2804 wrote to memory of 2792	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	30
PID 2804 wrote to memory of 2792	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	30
PID 2804 wrote to memory of 2792	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	30
PID 2804 wrote to memory of 2908	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	31
PID 2804 wrote to memory of 2908	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	31
PID 2804 wrote to memory of 2908	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	31
PID 2804 wrote to memory of 2908	2804	{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe	31
PID 2792 wrote to memory of 2388	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	34
PID 2792 wrote to memory of 2388	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	34
PID 2792 wrote to memory of 2388	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	34
PID 2792 wrote to memory of 2388	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	34
PID 2792 wrote to memory of 524	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	35
PID 2792 wrote to memory of 524	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	35
PID 2792 wrote to memory of 524	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	35
PID 2792 wrote to memory of 524	2792	{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe	35
PID 2388 wrote to memory of 1520	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	36
PID 2388 wrote to memory of 1520	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	36
PID 2388 wrote to memory of 1520	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	36
PID 2388 wrote to memory of 1520	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	36
PID 2388 wrote to memory of 1284	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	37
PID 2388 wrote to memory of 1284	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	37
PID 2388 wrote to memory of 1284	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	37
PID 2388 wrote to memory of 1284	2388	{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe	37
PID 1520 wrote to memory of 3024	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	39
PID 1520 wrote to memory of 3024	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	39
PID 1520 wrote to memory of 3024	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	39
PID 1520 wrote to memory of 3024	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	39
PID 1520 wrote to memory of 2404	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	38
PID 1520 wrote to memory of 2404	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	38
PID 1520 wrote to memory of 2404	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	38
PID 1520 wrote to memory of 2404	1520	{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe	38
PID 3024 wrote to memory of 1124	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	40
PID 3024 wrote to memory of 1124	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	40
PID 3024 wrote to memory of 1124	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	40
PID 3024 wrote to memory of 1124	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	40
PID 3024 wrote to memory of 952	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	41
PID 3024 wrote to memory of 952	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	41
PID 3024 wrote to memory of 952	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	41
PID 3024 wrote to memory of 952	3024	{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe	41
PID 1124 wrote to memory of 1136	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	42
PID 1124 wrote to memory of 1136	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	42
PID 1124 wrote to memory of 1136	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	42
PID 1124 wrote to memory of 1136	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	42
PID 1124 wrote to memory of 2204	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	43
PID 1124 wrote to memory of 2204	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	43
PID 1124 wrote to memory of 2204	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	43
PID 1124 wrote to memory of 2204	1124	{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe	43
PID 1136 wrote to memory of 2880	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	44
PID 1136 wrote to memory of 2880	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	44
PID 1136 wrote to memory of 2880	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	44
PID 1136 wrote to memory of 2880	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	44
PID 1136 wrote to memory of 2872	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	45
PID 1136 wrote to memory of 2872	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	45
PID 1136 wrote to memory of 2872	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	45
PID 1136 wrote to memory of 2872	1136	{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_068ce879b0ff9b560bec4a3669ac9456_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
  C:\Windows\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
    C:\Windows\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
      C:\Windows\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Windows\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
        
        C:\Windows\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CB45~1.EXE > nul
        6⤵
        
        PID:2404
      - C:\Windows\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
        
        C:\Windows\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
        
        C:\Windows\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
        
        C:\Windows\{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
        
        C:\Windows\{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
        
        C:\Windows\{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe
        
        C:\Windows\{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\{809A17B6-8680-4f28-BCBD-7725BB027633}.exe
        
        C:\Windows\{809A17B6-8680-4f28-BCBD-7725BB027633}.exe
        12⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48DED~1.EXE > nul
        12⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B3E6C~1.EXE > nul
        11⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54829~1.EXE > nul
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0791E~1.EXE > nul
        9⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9CF67~1.EXE > nul
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{546B6~1.EXE > nul
        7⤵
        
        PID:952
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FCE9F~1.EXE > nul
        5⤵
        
        PID:1284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8D5F9~1.EXE > nul
      4⤵
      PID:524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C2875~1.EXE > nul
    3⤵
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0791E8B1-3274-4c37-BE36-4B83331C95A5}.exe

Filesize
180KB

MD5
b62e532af4573e2e21533c7ad9b981d0

SHA1
a451e441df9316ed44bfdcefb5f4b45bbbc3027c

SHA256
af70ba758d205718585adb3907169660ebc1a76e57013f117bdd8890e0974224

SHA512
d522fad36a0e28a75b735527bdf9022bf10590446bc53d641e469b6eb6980ae121feaf6132a7be4071f118779c0e22b60c4d0693fd520c6a7de708bc71a20109

Download Submit
C:\Windows\{48DEDCB8-2A04-499e-8EAB-18843A91578A}.exe

Filesize
180KB

MD5
2a37f4841445e1c88c230185ae2c85fa

SHA1
a4c577ea7f3981ed38859c232f53f8d36ac8a5fd

SHA256
a88ec5eea3f043008422c309eed2a4b713f3bf98b186626da78c1516c6ed8693

SHA512
69af3fc3b7494ec637ccacbba3ddce5d45c9a047e824024fe78e6da0f837b2898c0db485af61d00d5a81c807450de2485df5d740cf542fbf594ce78d745a0ae5

Download Submit
C:\Windows\{546B6D03-2BDB-416e-A27E-4E54AE9B4AC4}.exe

Filesize
180KB

MD5
891097ee83cda3c2cfbef4eba7af04fd

SHA1
7c4845ff078741847e9f98161c990cc1d4bff699

SHA256
bd9db9822bcd605526999c6c25a71e5bc3957ace7784a9ca9bb6789ec957abb7

SHA512
2af5070e76fd6bd11374350714fcd561477cac3c7038ebf622be1a15c16166fe21dc61da5137c9714184d876a71dad7712e340d464afea8ddeb1bdb7d728436f

Download Submit
C:\Windows\{5482956A-C604-4008-A1F4-A59ED6130ECA}.exe

Filesize
180KB

MD5
9c8fa04ec971c73567820abebb90609b

SHA1
eb2e68d10a0f88d6065fedbfffafba3b8741fea4

SHA256
6f1f054177377164870712722b36e6410922caa144dba8d00cf7b22b875df08b

SHA512
7d26bc5c86fbfbbfc5ff063408513332a8862b48fb04f6d225203b117a3610cece484d07935bfb465dce85785c922313451460c70694bdcb3186a8736075dcfd

Download Submit
C:\Windows\{6CB450A1-DC0C-428f-B8F0-833B6D171B0B}.exe

Filesize
180KB

MD5
c8fe145fad92b2b5c95455c8802581d2

SHA1
2cc95ef98faae0179095e7a6712d7d9a6bb4863f

SHA256
7318c63ff2da33c004835998bb85950e1918850a3100976a166944edbb5a13df

SHA512
d671d32dc651f768fdfaaf42f1cb43051c39eaf3707c8936da760184e36023833f426baff25df79dcd4cf91bbbbb878fefb1809824e57e848fde7647bfa17c54

Download Submit
C:\Windows\{809A17B6-8680-4f28-BCBD-7725BB027633}.exe

Filesize
180KB

MD5
6e1c3ca0326120d9db958ada9d0cd5bf

SHA1
e55fcbf8527889d956b804e977a148da2b3b1ac1

SHA256
f8c6dbb603db371faf331d7958e043e52e7cd26a63d112b79da19fe13c4e5fa4

SHA512
8aab218dba7f4efdebe3931ccd5aaa737f0bba3942b7ed817c6ef042571c85e934fb31b7cbb258bad13cebad4483c6303a0a1ce058862ebc558b118335ea1f34

Download Submit
C:\Windows\{8D5F989E-1AEB-48be-BB5F-A9BC2CBCC5E8}.exe

Filesize
180KB

MD5
1d3fdfbb6cd7060374f910737e395817

SHA1
d1d42cef3d24d3b1584de3bcd2ca80cd5b9669df

SHA256
67458f0bd765fc791ae2bf9ac8fe93962477f75a401b931edbe74241c5d12354

SHA512
7daa282e0c7063009de576ac2fa77d0fff8cee0bb57cf327b85fdf2e8f18180eeff73df9fcb3d27499ca3dc229b98e46bd29a52fd189539ce5ff964207e17e7f

Download Submit
C:\Windows\{9CF67C19-5E93-47b5-89A3-4CB4C5FFEB69}.exe

Filesize
180KB

MD5
beeca72b03d5634fd5bef1f5ef2f52e5

SHA1
1dcd9af91bdc9d1160d1284d4be5e2c6227ad0ae

SHA256
fc13766fa3a249fd5789c6ef1c45436bb8ba1c294b7d7caa9c1ef6caa7b40549

SHA512
fcd8142c9d39b61c5161e0e33403b7618e1c288025d920f713ef161047030bd6aa872a94a4e51713ca52b30b58e22453f626c6af4e789b0c660f39e68bc5c896

Download Submit
C:\Windows\{B3E6C466-A7CB-4ac6-BE63-647452B71670}.exe

Filesize
180KB

MD5
3fd004511f0a98cd110590f260d928a3

SHA1
8344d852fcc250318938710076c7811504742c1a

SHA256
8390c2c0b4bfd1522144e877344045932a20275604fc326d6df18fd6ce039e07

SHA512
5e743cc8a5cca17c3851ce015ec86c55bc8d20f88d39b1b534eeaa554204f89defacfe3cf53c22d5dc764dc33738b61986e1467e24f6defcd686adb7869f3182

Download Submit
C:\Windows\{C2875AC6-F7BA-4cb3-ACAA-CB15026FAAF7}.exe

Filesize
180KB

MD5
02a77a4abb7054834677f4cca5bed8a5

SHA1
8be7c7fb4090175fd90d7b1bf22e6b248bcb621b

SHA256
f6c5c6e4f8bba3954867ef3d124fd5fba2aee84ecc76be382c00d02ec74e7a15

SHA512
995cf5422661f44c2b4a5a9834ea46d0fa9f8b36df0bdaeb5c81b9c972b34cbac4b393a261ee7b585134f44c789530a190aac6fd95fa59f84d18a3fe63511c99

Download Submit
C:\Windows\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe

Filesize
5KB

MD5
34bc67e64361094aebdf0880ec3a03b9

SHA1
bdd62bd41284d2f325dc7151c4feb3e572e8113f

SHA256
6fdbe4983ec12a214d59949a9281e8956092ce8f026f6852f412f112fbf126e5

SHA512
c72a4da39cf90d30074f185a362d478022bb48d5dd7b358153ce9740a9765d5a54ffb9067caba283de0971900a3bf1e36b3aae224fbf2d172104aaefd33796a0

Download Submit
C:\Windows\{FCE9F1A3-3A02-4320-8021-CAACD48C3900}.exe

Filesize
180KB

MD5
4b656c7de00a8a54b1cec8f5ca61658b

SHA1
56b5ee33a2b8d80445b6950d556a8f0e94ee3279

SHA256
a55f97881bbf83686063e5a2d36f72790817320459c6df0678259ea0d49222a5

SHA512
83b566cde6ad311141fa9b4d150fb1708171d90782486affd1d7436b39f03f5a740026b29131ab3a16182cccd5d4da134ee5d90b7c390b1647458f9d591e69b1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads