f3be57df0353f24a8748685606fc4fe3184fe6ac5ac1c517cb26384ad4264736

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
Size

168KB
MD5

f545279219c36d29d20b8a2181a2c0d3
SHA1

265fa349b42c9f69e8f0b2e579a57fa1a2d98be2
SHA256

f3be57df0353f24a8748685606fc4fe3184fe6ac5ac1c517cb26384ad4264736
SHA512

860ecfca0b7edc9af88894e5ad0613456e9cf93a6f6a424462ed4686ab09a391ee5ff0f426464aed8babd3cc7acfb2ca258df148cef86624e4f8a5ffaa1c1f73
SSDEEP

1536:1EGh0oDlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oDlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012262-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001230d-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012262-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0002000000010f1d-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0003000000010f1d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000010f1d-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000010f1d-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE381316-D930-4443-AB3C-2AB79D241BF9}\stubpath = "C:\\Windows\\{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe"	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}	{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}\stubpath = "C:\\Windows\\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe"	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF601EC2-DC8C-486c-8727-B038A5363FDC}	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}\stubpath = "C:\\Windows\\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe"	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CE381316-D930-4443-AB3C-2AB79D241BF9}	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}\stubpath = "C:\\Windows\\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe"	{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}\stubpath = "C:\\Windows\\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe"	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}\stubpath = "C:\\Windows\\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe"	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF601EC2-DC8C-486c-8727-B038A5363FDC}\stubpath = "C:\\Windows\\{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe"	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}	{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}	{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}\stubpath = "C:\\Windows\\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe"	{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}\stubpath = "C:\\Windows\\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe"	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}\stubpath = "C:\\Windows\\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe"	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}\stubpath = "C:\\Windows\\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe"	{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe

Deletes itself 1 IoCs

pid	Process
1892	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
752	{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
1680	{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe
880	{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
2356	{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe	{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
File created	C:\Windows\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
File created	C:\Windows\{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
File created	C:\Windows\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
File created	C:\Windows\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
File created	C:\Windows\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
File created	C:\Windows\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
File created	C:\Windows\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
File created	C:\Windows\{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
File created	C:\Windows\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe	{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
File created	C:\Windows\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe	{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
Token: SeIncBasePriorityPrivilege	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
Token: SeIncBasePriorityPrivilege	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
Token: SeIncBasePriorityPrivilege	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
Token: SeIncBasePriorityPrivilege	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
Token: SeIncBasePriorityPrivilege	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
Token: SeIncBasePriorityPrivilege	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
Token: SeIncBasePriorityPrivilege	752	{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
Token: SeIncBasePriorityPrivilege	1680	{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe
Token: SeIncBasePriorityPrivilege	880	{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2972	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	28
PID 2932 wrote to memory of 2972	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	28
PID 2932 wrote to memory of 2972	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	28
PID 2932 wrote to memory of 2972	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	28
PID 2932 wrote to memory of 1892	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	29
PID 2932 wrote to memory of 1892	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	29
PID 2932 wrote to memory of 1892	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	29
PID 2932 wrote to memory of 1892	2932	2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe	29
PID 2972 wrote to memory of 2308	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	30
PID 2972 wrote to memory of 2308	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	30
PID 2972 wrote to memory of 2308	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	30
PID 2972 wrote to memory of 2308	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	30
PID 2972 wrote to memory of 2192	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	31
PID 2972 wrote to memory of 2192	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	31
PID 2972 wrote to memory of 2192	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	31
PID 2972 wrote to memory of 2192	2972	{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe	31
PID 2308 wrote to memory of 2948	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	32
PID 2308 wrote to memory of 2948	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	32
PID 2308 wrote to memory of 2948	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	32
PID 2308 wrote to memory of 2948	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	32
PID 2308 wrote to memory of 2828	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	33
PID 2308 wrote to memory of 2828	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	33
PID 2308 wrote to memory of 2828	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	33
PID 2308 wrote to memory of 2828	2308	{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe	33
PID 2948 wrote to memory of 2692	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	36
PID 2948 wrote to memory of 2692	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	36
PID 2948 wrote to memory of 2692	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	36
PID 2948 wrote to memory of 2692	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	36
PID 2948 wrote to memory of 2600	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	37
PID 2948 wrote to memory of 2600	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	37
PID 2948 wrote to memory of 2600	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	37
PID 2948 wrote to memory of 2600	2948	{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe	37
PID 2692 wrote to memory of 2264	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	39
PID 2692 wrote to memory of 2264	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	39
PID 2692 wrote to memory of 2264	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	39
PID 2692 wrote to memory of 2264	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	39
PID 2692 wrote to memory of 2560	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	38
PID 2692 wrote to memory of 2560	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	38
PID 2692 wrote to memory of 2560	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	38
PID 2692 wrote to memory of 2560	2692	{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe	38
PID 2264 wrote to memory of 1088	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	41
PID 2264 wrote to memory of 1088	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	41
PID 2264 wrote to memory of 1088	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	41
PID 2264 wrote to memory of 1088	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	41
PID 2264 wrote to memory of 2164	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	40
PID 2264 wrote to memory of 2164	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	40
PID 2264 wrote to memory of 2164	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	40
PID 2264 wrote to memory of 2164	2264	{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe	40
PID 1088 wrote to memory of 2036	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	42
PID 1088 wrote to memory of 2036	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	42
PID 1088 wrote to memory of 2036	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	42
PID 1088 wrote to memory of 2036	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	42
PID 1088 wrote to memory of 2244	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	43
PID 1088 wrote to memory of 2244	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	43
PID 1088 wrote to memory of 2244	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	43
PID 1088 wrote to memory of 2244	1088	{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe	43
PID 2036 wrote to memory of 752	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	45
PID 2036 wrote to memory of 752	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	45
PID 2036 wrote to memory of 752	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	45
PID 2036 wrote to memory of 752	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	45
PID 2036 wrote to memory of 1056	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	44
PID 2036 wrote to memory of 1056	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	44
PID 2036 wrote to memory of 1056	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	44
PID 2036 wrote to memory of 1056	2036	{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_f545279219c36d29d20b8a2181a2c0d3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
  C:\Windows\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
    C:\Windows\{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
      C:\Windows\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
        
        C:\Windows\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FC95A~1.EXE > nul
        6⤵
        
        PID:2560
      - C:\Windows\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
        
        C:\Windows\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EAE8D~1.EXE > nul
        7⤵
        
        PID:2164
        
        C:\Windows\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
        
        C:\Windows\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
        
        C:\Windows\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A5C9~1.EXE > nul
        9⤵
        
        PID:1056
        
        C:\Windows\{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
        
        C:\Windows\{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE381~1.EXE > nul
        10⤵
        
        PID:592
        
        C:\Windows\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe
        
        C:\Windows\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
        
        C:\Windows\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
        
        C:\Windows\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe
        
        C:\Windows\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe
        12⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{124FF~1.EXE > nul
        12⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54F4C~1.EXE > nul
        11⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E5CBC~1.EXE > nul
        8⤵
        
        PID:2244
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{775E0~1.EXE > nul
        5⤵
        
        PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FF601~1.EXE > nul
      4⤵
      PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{16751~1.EXE > nul
    3⤵
    PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{124FF75E-26B7-4c22-86D2-420ABD52E5BC}.exe

Filesize
168KB

MD5
5d4ab7f5a673b2bef9ceb8a1da6d163d

SHA1
bdf956b6ec52631277cf4ee42c8dfdc3b2cc4409

SHA256
1610e3401c638166c738583f2852181f014101d402ddb553b85a8a6c8f5ecf59

SHA512
11275d815cf8c119cbd6acf1dc39078b6f6eb2ed4f9ff60f096414715777fe70a119fc925aeac4fad2911021208593726ceab51f7f75029fc2950a7f3d68485a

Download Submit
C:\Windows\{1675111A-C1D3-4163-9AEC-7626A9ED6A41}.exe

Filesize
168KB

MD5
9bcfc86f09f86d81f59592227b544e7c

SHA1
e9f46b87816505b82934482ffdacaf24c984998d

SHA256
2ee910268b4c0effd25f01e74f75ae91f7817af2c2953435265552453744b36d

SHA512
f2374eaa5ec6485dd4e0e1cc63b81b9c8ce9cd60dd900c35fa74e94ec0a2d557938e61960d6d2d1e683e0be3218a62bd93fcb4f0cb1a84bbb10ed1abc5434eee

Download Submit
C:\Windows\{54F4C1E9-1E02-4138-AFCC-6F807C954D3D}.exe

Filesize
168KB

MD5
6c086868d20e357520eb4ece64f1774b

SHA1
59052d4a828226b8e22c9e6a6639124f88c3f524

SHA256
1a0834b7df77e22640673fa4f9eb8f14f0c5bade91023705a2154d472268340b

SHA512
2ff64c0cb220c2eec5d30be90c95a7a42bb5a4757ad19d474ddc023ea3868cf523614125835874aed4cd6a9c94949bcd0c1b8f668257349f059d56d777398dfa

Download Submit
C:\Windows\{775E00CE-9797-4e9c-8CE8-D07202A63EF2}.exe

Filesize
168KB

MD5
483660f2a04149719d08795073ff697c

SHA1
282552db0188093138173af6471c4b192b953d9b

SHA256
900fb0a7435cc8d29bbd54c6d924c34d67b951cdd1463525dbd0948d1e73236c

SHA512
354111cbe991c04b4b4df0258062bb7f69982230f3f12f5236f9ffb07dd6d65bf4eaf8ce5102ffdb30476c071201198458712f7740d740b306c2a176ae2d8c5b

Download Submit
C:\Windows\{8863BFB8-EEED-45ef-ADFE-DA98184434BB}.exe

Filesize
168KB

MD5
f461544cc164de22200c353c4de055dc

SHA1
ed4191b52c0f1dfbabeb5dd87bf6056ac24e6ae3

SHA256
37af27d7ea9be0050d81ccacff6599d5e3f5676c2c2255c599c09fc75155d435

SHA512
594470763a3678158a40493aa089950042886756bc141e7f6a709491a7dd00cc90dbd23bfa8a651848541914362b236b64ee8876736f486efc890a5067b455ac

Download Submit
C:\Windows\{9A5C9B1A-8D09-4ccc-BDC2-8635DB4286BF}.exe

Filesize
168KB

MD5
335143a72b2e16fb76cb7ada38a56fd9

SHA1
95f33c3df7b84cb52049784eb26b5e0424f7ad60

SHA256
d3e5bc444b1bfcd3fe365692cd39075b1b4286795cec5f5bc5a69459aef61f20

SHA512
c7a00bcb9e50a64790e598bb31fe736ccbaf70e4af638a71fbe3911a3e9b2624f155d0ee4d4600a66973da31bafab39a41a0a5b66080497ca2727a83b65ffa6f

Download Submit
C:\Windows\{CE381316-D930-4443-AB3C-2AB79D241BF9}.exe

Filesize
168KB

MD5
ded2b8c3121b147d16fd98ea93ab1356

SHA1
a040a2caf6e01d3240b1e391845f26f7bec31a1a

SHA256
703ce8e50bb78c788efa937f72803a0abfb0b12c88a4edf1e122d0e85fd9b500

SHA512
8eec8e99406451e1ee20470f297522d12cbd791ef2cff552b2de5756d9410c2887c7d68d39149ab3cc147ae6030a051e5d758e50a488a08b9f49a810065454aa

Download Submit
C:\Windows\{E5CBC1B0-C0BA-4d54-B58E-7073AD6E4889}.exe

Filesize
168KB

MD5
b0547df1855b095071af06c788f4515f

SHA1
d1c24b6e845c0080d180e986bfbd1471deeb26d4

SHA256
6b68b84ff09fabbaa8f432a97025502f0e6760b5b6e200b81dc4a80291e227fa

SHA512
587118c8eac69fd4b7c05ce2712b7e7d28d6048a7fe98b37483816ca246943de6ad850ab4a75b75a09e36ec9193f795b43d8231f5d4af77e69e7db4a20047073

Download Submit
C:\Windows\{EAE8DAF6-EDD1-4dbe-9A27-B06CA3013D81}.exe

Filesize
168KB

MD5
03fa87d4642285a2f1e6cf86a37d440f

SHA1
57e73f0fb2a6101f1159fbd3a91237ba43c6db43

SHA256
c1353d4c29a67b6c239e73bd3a75716dab95f12f1881c22b39fc4d86afe56b3c

SHA512
77f36770013fcf9126c7908a07cc10722b3c32aa72cde23ce3dabaa8babcfdd5de1df4b8fe5efbb91673e0f48581893c7d82236822f56ebba7f8cf70277f916f

Download Submit
C:\Windows\{FC95A2A1-97CF-40c4-A899-4EAFBC73F481}.exe

Filesize
168KB

MD5
003b1df1f2935e88d20210d89cc609f3

SHA1
d016125f0ecf055aee52ba9c4f805476e6429dec

SHA256
cd568f72476df910eab033e7be90493eb96143c1b3382ef06693bdceea9deb8e

SHA512
472e13eb1236be31aa02a469b325b158a0e306211cafc6d979dc422b555eb31758b8c2a85ebd1e492860acab0c09b5e41259a4c72036994d2ef81c00f94a1c04

Download Submit
C:\Windows\{FF601EC2-DC8C-486c-8727-B038A5363FDC}.exe

Filesize
168KB

MD5
212d2040bdf2a61074ba8985433d2c85

SHA1
e74c2b2f883be7322836024ee424a4ca8bb2290d

SHA256
000253b73abc1fbc964dc79711f0b9e70ba900ecaf826c9c61283823f9cb21bb

SHA512
77f1d91f5186ea11456218d257005cc68657984cb4e7fe0ff50c3d47acc14a5a7ccd833efe483bc643db827c8e7819640f1e45f84ee2dbcba2bf2da30adcb261

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads