17cf783625db848bec7b69db30ca23548dce74daccd29a12bf3baa2337155f92

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
Size

408KB
MD5

053d3d9d73dae942303cda04014f3964
SHA1

7a7baebf8bf3a86ced5757d0fd7f6efee1cd8b81
SHA256

17cf783625db848bec7b69db30ca23548dce74daccd29a12bf3baa2337155f92
SHA512

9023babb8cec16ee2c31a760c12d452c6a9acdaeaf961914f2c59694b608e89c5df56ca5ce41d7b5bcc87aa29ae94c96dee86bd7aa9df7f47506348f17b5df40
SSDEEP

3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGwldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000013d89-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012251-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f000000015d58-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012251-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012251-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012251-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}\stubpath = "C:\\Windows\\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe"	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}	{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}\stubpath = "C:\\Windows\\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe"	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2A29034-33C1-45e7-9E68-C1CC970D024A}\stubpath = "C:\\Windows\\{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe"	{BC92B290-23CB-4868-9933-05C28008C85E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{56987DCF-C21F-4de7-B260-E9EEC1427F09}	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}\stubpath = "C:\\Windows\\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe"	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}\stubpath = "C:\\Windows\\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe"	{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31B9B660-F1B6-4175-A9F5-A647D182253B}\stubpath = "C:\\Windows\\{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe"	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{382C038D-DB5C-4d87-A255-8CADACBF1889}	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{31B9B660-F1B6-4175-A9F5-A647D182253B}	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{56987DCF-C21F-4de7-B260-E9EEC1427F09}\stubpath = "C:\\Windows\\{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe"	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}	{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D648832A-1E6D-40b8-9E43-468C2E510EB1}\stubpath = "C:\\Windows\\{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe"	{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC92B290-23CB-4868-9933-05C28008C85E}	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{382C038D-DB5C-4d87-A255-8CADACBF1889}\stubpath = "C:\\Windows\\{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe"	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}\stubpath = "C:\\Windows\\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe"	{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D648832A-1E6D-40b8-9E43-468C2E510EB1}	{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC92B290-23CB-4868-9933-05C28008C85E}\stubpath = "C:\\Windows\\{BC92B290-23CB-4868-9933-05C28008C85E}.exe"	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2A29034-33C1-45e7-9E68-C1CC970D024A}	{BC92B290-23CB-4868-9933-05C28008C85E}.exe

Deletes itself 1 IoCs

pid	Process
2780	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe
2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
332	{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
2248	{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
604	{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe
572	{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
File created	C:\Windows\{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	{BC92B290-23CB-4868-9933-05C28008C85E}.exe
File created	C:\Windows\{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
File created	C:\Windows\{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
File created	C:\Windows\{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe	{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
File created	C:\Windows\{BC92B290-23CB-4868-9933-05C28008C85E}.exe	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
File created	C:\Windows\{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
File created	C:\Windows\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
File created	C:\Windows\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
File created	C:\Windows\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe	{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
File created	C:\Windows\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe	{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
Token: SeIncBasePriorityPrivilege	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe
Token: SeIncBasePriorityPrivilege	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
Token: SeIncBasePriorityPrivilege	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
Token: SeIncBasePriorityPrivilege	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
Token: SeIncBasePriorityPrivilege	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
Token: SeIncBasePriorityPrivilege	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
Token: SeIncBasePriorityPrivilege	332	{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
Token: SeIncBasePriorityPrivilege	2248	{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
Token: SeIncBasePriorityPrivilege	604	{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2668	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	28
PID 2332 wrote to memory of 2668	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	28
PID 2332 wrote to memory of 2668	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	28
PID 2332 wrote to memory of 2668	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	28
PID 2332 wrote to memory of 2780	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	29
PID 2332 wrote to memory of 2780	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	29
PID 2332 wrote to memory of 2780	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	29
PID 2332 wrote to memory of 2780	2332	2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe	29
PID 2668 wrote to memory of 2852	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	30
PID 2668 wrote to memory of 2852	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	30
PID 2668 wrote to memory of 2852	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	30
PID 2668 wrote to memory of 2852	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	30
PID 2668 wrote to memory of 2592	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	31
PID 2668 wrote to memory of 2592	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	31
PID 2668 wrote to memory of 2592	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	31
PID 2668 wrote to memory of 2592	2668	{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe	31
PID 2852 wrote to memory of 2488	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	33
PID 2852 wrote to memory of 2488	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	33
PID 2852 wrote to memory of 2488	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	33
PID 2852 wrote to memory of 2488	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	33
PID 2852 wrote to memory of 2568	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	32
PID 2852 wrote to memory of 2568	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	32
PID 2852 wrote to memory of 2568	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	32
PID 2852 wrote to memory of 2568	2852	{BC92B290-23CB-4868-9933-05C28008C85E}.exe	32
PID 2488 wrote to memory of 676	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	36
PID 2488 wrote to memory of 676	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	36
PID 2488 wrote to memory of 676	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	36
PID 2488 wrote to memory of 676	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	36
PID 2488 wrote to memory of 1204	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	37
PID 2488 wrote to memory of 1204	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	37
PID 2488 wrote to memory of 1204	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	37
PID 2488 wrote to memory of 1204	2488	{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe	37
PID 676 wrote to memory of 2288	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	39
PID 676 wrote to memory of 2288	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	39
PID 676 wrote to memory of 2288	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	39
PID 676 wrote to memory of 2288	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	39
PID 676 wrote to memory of 1872	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	38
PID 676 wrote to memory of 1872	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	38
PID 676 wrote to memory of 1872	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	38
PID 676 wrote to memory of 1872	676	{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe	38
PID 2288 wrote to memory of 1792	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	40
PID 2288 wrote to memory of 1792	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	40
PID 2288 wrote to memory of 1792	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	40
PID 2288 wrote to memory of 1792	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	40
PID 2288 wrote to memory of 1968	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	41
PID 2288 wrote to memory of 1968	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	41
PID 2288 wrote to memory of 1968	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	41
PID 2288 wrote to memory of 1968	2288	{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe	41
PID 1792 wrote to memory of 2116	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	43
PID 1792 wrote to memory of 2116	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	43
PID 1792 wrote to memory of 2116	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	43
PID 1792 wrote to memory of 2116	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	43
PID 1792 wrote to memory of 1596	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	42
PID 1792 wrote to memory of 1596	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	42
PID 1792 wrote to memory of 1596	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	42
PID 1792 wrote to memory of 1596	1792	{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe	42
PID 2116 wrote to memory of 332	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	44
PID 2116 wrote to memory of 332	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	44
PID 2116 wrote to memory of 332	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	44
PID 2116 wrote to memory of 332	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	44
PID 2116 wrote to memory of 1692	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	45
PID 2116 wrote to memory of 1692	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	45
PID 2116 wrote to memory of 1692	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	45
PID 2116 wrote to memory of 1692	2116	{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_053d3d9d73dae942303cda04014f3964_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
  C:\Windows\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\{BC92B290-23CB-4868-9933-05C28008C85E}.exe
    C:\Windows\{BC92B290-23CB-4868-9933-05C28008C85E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BC92B~1.EXE > nul
      4⤵
      PID:2568
  - - C:\Windows\{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
      C:\Windows\{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
        
        C:\Windows\{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31B9B~1.EXE > nul
        6⤵
        
        PID:1872
      - C:\Windows\{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
        
        C:\Windows\{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
        
        C:\Windows\{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56987~1.EXE > nul
        8⤵
        
        PID:1596
        
        C:\Windows\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
        
        C:\Windows\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
        
        C:\Windows\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
        
        C:\Windows\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
        
        C:\Windows\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe
        
        C:\Windows\{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6488~1.EXE > nul
        12⤵
        
        PID:1896
        
        C:\Windows\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe
        
        C:\Windows\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe
        12⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2CCB7~1.EXE > nul
        11⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E13A~1.EXE > nul
        10⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD38A~1.EXE > nul
        9⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{382C0~1.EXE > nul
        7⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2A29~1.EXE > nul
        5⤵
        
        PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1408B~1.EXE > nul
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1408BCC1-70CC-49a8-9146-26EFD0D3D665}.exe

Filesize
408KB

MD5
520a74474540745ff3d79b7b12661a5f

SHA1
47262779b04b04e4fa48a5cc5874afedd804423c

SHA256
92cd1b9f05252ce9389770d1a5e7a604185f4fbd15ff973af39ec56261e7306c

SHA512
4a0cb87977f8ddbb619b1f6ada5447c358212178ab813cd68c2c5bf24c45de00c2b29a0c09b291a7e922d841b96e069d6e7a929e3b54f3e6f7998c324e226838

Download Submit
C:\Windows\{2CCB7199-E444-4e4c-AEE1-6FFFF46C28BB}.exe

Filesize
408KB

MD5
4cb724e7cf57b66a372a8c48dbc6e9ef

SHA1
2f7d1ca1da41f94ee28e92999dfc9ae2c40e4fb7

SHA256
6687440f566c9a5f772bb86cb2e6e7d5a5c4cf39c30610dec684ef06e5d24dc7

SHA512
5147720b6c1434905e8d5883d349080dc784a03eae9092468c60dbc5f94386988832bad610bde0c251fbe519ef2b2927029bef6deb95a0c5975598fe79d1d23f

Download Submit
C:\Windows\{31B9B660-F1B6-4175-A9F5-A647D182253B}.exe

Filesize
408KB

MD5
71a52d407fbb05de4c302ea9e389f201

SHA1
4ad6bab1cec79af970e31b111934d085d9b99b5c

SHA256
facf48118074b684c6507f9d3423e15ea2c56d7a3f89cba7611ffc634e435372

SHA512
520082b233091e9f9cdf60b4e894157a540a8555ab7f9e78464a73a75edf581d7a90603e9260502e7ad946eff7a170891aae7368788eac6dc84771a9305b546f

Download Submit
C:\Windows\{382C038D-DB5C-4d87-A255-8CADACBF1889}.exe

Filesize
408KB

MD5
76c23f0d3d2a5c5abcf708b2c430e874

SHA1
c378fe14bf52565373b42f7331b346564f2f7217

SHA256
155dada94b563411ed1b91af716ef19548c001ffa24e7db9021fc717f5c8a38e

SHA512
3e37f34fc10de4ec6b236140702b66c5e9946ad3f0ff320dc22862ed10a8f8e461bd9ea2ec02c758fe79513b5e91a4990c5c2059e2ed8888a6b28729c6992384

Download Submit
C:\Windows\{56987DCF-C21F-4de7-B260-E9EEC1427F09}.exe

Filesize
408KB

MD5
c4454217815ff8b45ea29e481aa3b260

SHA1
ccc4629e6285b333469c5285eedfc3ba23d381d0

SHA256
942f655303988c670ff3c7e423122fcb4a477f67b8c9a491af5d89abc88cfbcf

SHA512
020ae9e47b4b1cee1d161e8d0a94a3678e4f56f1d85711bf9f943ddba80864d05d7d0b6a156e27b8821284aacbd176928724ba513b082e50f5a9fd0baffc433d

Download Submit
C:\Windows\{7E13A3E5-B3C5-4c11-B7E4-C6B85C74C336}.exe

Filesize
408KB

MD5
203fea38989ce326c5da97b4f3706d38

SHA1
c82e0457279308bcce71f22e8c412989c8b77ec8

SHA256
03c66a0f4e6483488ecbfbf169b4209e407b94ec917bf30e202c9a455cf6cc03

SHA512
3fa3824b4ff406d7a0a06e719d41c91982125cde9c2de9fe97469a44ceb2bd63f8011dec42a8e54b044e47a56135d611757b96717f9b4ae5659fc983b7edc874

Download Submit
C:\Windows\{A2A29034-33C1-45e7-9E68-C1CC970D024A}.exe

Filesize
408KB

MD5
6bc4178e811130552f66e9a6664ae357

SHA1
5fb38888e70d08578796bb211a0d3ef3b25582f3

SHA256
373a45172247e09a399221e16756fbbb6908cf6233df57968511fb9ae490d40e

SHA512
f7ad9e4866e36d2fb53aed32272c4235150afd2db4f169fba4ad4b81f386ee4e76faa3eee686369c2c2697397db6bfcbb8ad6669c401c21332776ac7cb414e0d

Download Submit
C:\Windows\{BC92B290-23CB-4868-9933-05C28008C85E}.exe

Filesize
408KB

MD5
af636a14812ee597452a79f1b9be4cd1

SHA1
893c90f6c0bc64e87b851bf0251571ad51f1ed40

SHA256
4b348de0ff9337265b1b8642b2b59abe447e6285bbdfec951eef12a9a3e8fdb0

SHA512
7d383f744b4a93bdc8fed0d8a8439bb7cec81df30aaaa3c0d1f903a4cb2b15229f772fdf65d188b4efaf9dadf683509e92456db0c1a525ee0f80f46e0e0977af

Download Submit
C:\Windows\{D5C7224D-D8A5-41ac-A13B-CA640C358A4E}.exe

Filesize
408KB

MD5
f918c505b2d00c959f7500bec2bda0bb

SHA1
e2dff84d10a00fb3e22713e96034548d1f1167e9

SHA256
24fc251048b036701c18cdb70459cceb0395ca866026e56074eb8f7fd4e18c55

SHA512
e058f1e3be26054edcd5590fc9f3f242e24090b000f7e479d55f72b3709ad376b6e12583d44f6fdacbe0b729fbd1849c4baa569390f60d9ffab5260f7a98c7f5

Download Submit
C:\Windows\{D648832A-1E6D-40b8-9E43-468C2E510EB1}.exe

Filesize
408KB

MD5
2f0baa1fc8be1de851d746f3b38bd6a5

SHA1
1ef715db755e559fe3a3db9fe70f0f52c2e91116

SHA256
8143b2ee2d02c5a58a4c35133003516d83afcb1af46c76226d9c539ba776a541

SHA512
aac499892fdf3d64de775846ff844fb3ce7fdd68ebe65a52ee2e1ac4a97cde56b0cd905f464900b1447d5dcae884363e64b398f0f51d588349eadf120971af74

Download Submit
C:\Windows\{FD38AFF0-9014-4715-BB79-BC3F63145F4A}.exe

Filesize
408KB

MD5
be8ad13c3662e739faf943fa1ae00616

SHA1
0a76094e1dcfd25c43bcc83d50c1ab18cc23184d

SHA256
8e8fae73a9cf038f3d41dcccc9dc30ccf2b8d543d2f0bbecd6365ab67a0a8f10

SHA512
064fbb910732f7fccd352e7d6c3c4555440b7e1e1e9ba14944ec2f7137639f20d51e32d924260910e2e8943d543615768dda1cac2ec7d68cc30512a28a5cca82

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads