cf7516467c41e7395ae2a0140c23eb9f5d9dadbb64ea7b104fafc5ea4c22e81a

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
Size

408KB
MD5

2dd62cbf4e13bd11bf8eebc33b0caa4d
SHA1

045e3f2dc462fb33b9f27a248606987e21956006
SHA256

cf7516467c41e7395ae2a0140c23eb9f5d9dadbb64ea7b104fafc5ea4c22e81a
SHA512

b7a7fe285719c1cfd29ea472c56122aeac72490a3ad49b486fb4968e77bf353ba9c10f7a89b0a370dfd1932b96cd3a51a59aba08270de3e4df55edb8b43b89ef
SSDEEP

3072:CEGh0oHl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGBldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014826-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014ac0-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014826-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000001560b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a5a-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014826-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a5a-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014826-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a5a-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014826-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a5a-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}\stubpath = "C:\\Windows\\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe"	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F412AC15-5652-439b-9244-EE4B631C3D87}\stubpath = "C:\\Windows\\{F412AC15-5652-439b-9244-EE4B631C3D87}.exe"	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05DD4C31-0535-4266-8A29-B1FB3276C469}\stubpath = "C:\\Windows\\{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe"	{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A6A1EB7-5798-42a3-963B-91D30531B233}	{2AE55241-2870-4493-8034-ECE9534DE347}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14EE025E-D0F7-4827-9A26-A6446A689685}\stubpath = "C:\\Windows\\{14EE025E-D0F7-4827-9A26-A6446A689685}.exe"	{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{131727DC-D11F-4f3d-9DDD-C51F46E38935}\stubpath = "C:\\Windows\\{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe"	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2AE55241-2870-4493-8034-ECE9534DE347}	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2AE55241-2870-4493-8034-ECE9534DE347}\stubpath = "C:\\Windows\\{2AE55241-2870-4493-8034-ECE9534DE347}.exe"	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05DD4C31-0535-4266-8A29-B1FB3276C469}	{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{131727DC-D11F-4f3d-9DDD-C51F46E38935}	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}\stubpath = "C:\\Windows\\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe"	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}\stubpath = "C:\\Windows\\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe"	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F412AC15-5652-439b-9244-EE4B631C3D87}	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14EE025E-D0F7-4827-9A26-A6446A689685}	{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{666BAA9F-5521-4043-BC5B-0FC85C509534}	{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{666BAA9F-5521-4043-BC5B-0FC85C509534}\stubpath = "C:\\Windows\\{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe"	{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A6A1EB7-5798-42a3-963B-91D30531B233}\stubpath = "C:\\Windows\\{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe"	{2AE55241-2870-4493-8034-ECE9534DE347}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}\stubpath = "C:\\Windows\\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe"	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe

Deletes itself 1 IoCs

pid	Process
1848	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe
2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
1636	{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
1708	{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
336	{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
2252	{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	{2AE55241-2870-4493-8034-ECE9534DE347}.exe
File created	C:\Windows\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
File created	C:\Windows\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
File created	C:\Windows\{14EE025E-D0F7-4827-9A26-A6446A689685}.exe	{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
File created	C:\Windows\{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
File created	C:\Windows\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
File created	C:\Windows\{2AE55241-2870-4493-8034-ECE9534DE347}.exe	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
File created	C:\Windows\{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe	{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
File created	C:\Windows\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
File created	C:\Windows\{F412AC15-5652-439b-9244-EE4B631C3D87}.exe	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
File created	C:\Windows\{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe	{14EE025E-D0F7-4827-9A26-A6446A689685}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
Token: SeIncBasePriorityPrivilege	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
Token: SeIncBasePriorityPrivilege	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
Token: SeIncBasePriorityPrivilege	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe
Token: SeIncBasePriorityPrivilege	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
Token: SeIncBasePriorityPrivilege	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
Token: SeIncBasePriorityPrivilege	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
Token: SeIncBasePriorityPrivilege	1636	{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
Token: SeIncBasePriorityPrivilege	1708	{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
Token: SeIncBasePriorityPrivilege	336	{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3012	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	28
PID 2008 wrote to memory of 3012	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	28
PID 2008 wrote to memory of 3012	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	28
PID 2008 wrote to memory of 3012	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	28
PID 2008 wrote to memory of 1848	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	29
PID 2008 wrote to memory of 1848	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	29
PID 2008 wrote to memory of 1848	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	29
PID 2008 wrote to memory of 1848	2008	2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe	29
PID 3012 wrote to memory of 2660	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	30
PID 3012 wrote to memory of 2660	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	30
PID 3012 wrote to memory of 2660	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	30
PID 3012 wrote to memory of 2660	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	30
PID 3012 wrote to memory of 2588	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	31
PID 3012 wrote to memory of 2588	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	31
PID 3012 wrote to memory of 2588	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	31
PID 3012 wrote to memory of 2588	3012	{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe	31
PID 2660 wrote to memory of 2700	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	33
PID 2660 wrote to memory of 2700	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	33
PID 2660 wrote to memory of 2700	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	33
PID 2660 wrote to memory of 2700	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	33
PID 2660 wrote to memory of 1468	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	32
PID 2660 wrote to memory of 1468	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	32
PID 2660 wrote to memory of 1468	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	32
PID 2660 wrote to memory of 1468	2660	{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe	32
PID 2700 wrote to memory of 3020	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	36
PID 2700 wrote to memory of 3020	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	36
PID 2700 wrote to memory of 3020	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	36
PID 2700 wrote to memory of 3020	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	36
PID 2700 wrote to memory of 2076	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	37
PID 2700 wrote to memory of 2076	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	37
PID 2700 wrote to memory of 2076	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	37
PID 2700 wrote to memory of 2076	2700	{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe	37
PID 3020 wrote to memory of 2756	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	38
PID 3020 wrote to memory of 2756	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	38
PID 3020 wrote to memory of 2756	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	38
PID 3020 wrote to memory of 2756	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	38
PID 3020 wrote to memory of 1172	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	39
PID 3020 wrote to memory of 1172	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	39
PID 3020 wrote to memory of 1172	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	39
PID 3020 wrote to memory of 1172	3020	{2AE55241-2870-4493-8034-ECE9534DE347}.exe	39
PID 2756 wrote to memory of 2768	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	40
PID 2756 wrote to memory of 2768	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	40
PID 2756 wrote to memory of 2768	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	40
PID 2756 wrote to memory of 2768	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	40
PID 2756 wrote to memory of 948	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	41
PID 2756 wrote to memory of 948	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	41
PID 2756 wrote to memory of 948	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	41
PID 2756 wrote to memory of 948	2756	{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe	41
PID 2768 wrote to memory of 2728	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	42
PID 2768 wrote to memory of 2728	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	42
PID 2768 wrote to memory of 2728	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	42
PID 2768 wrote to memory of 2728	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	42
PID 2768 wrote to memory of 1696	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	43
PID 2768 wrote to memory of 1696	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	43
PID 2768 wrote to memory of 1696	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	43
PID 2768 wrote to memory of 1696	2768	{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe	43
PID 2728 wrote to memory of 1636	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	45
PID 2728 wrote to memory of 1636	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	45
PID 2728 wrote to memory of 1636	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	45
PID 2728 wrote to memory of 1636	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	45
PID 2728 wrote to memory of 2536	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	44
PID 2728 wrote to memory of 2536	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	44
PID 2728 wrote to memory of 2536	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	44
PID 2728 wrote to memory of 2536	2728	{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_2dd62cbf4e13bd11bf8eebc33b0caa4d_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
  C:\Windows\{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
    C:\Windows\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{662CA~1.EXE > nul
      4⤵
      PID:1468
  - - C:\Windows\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
      C:\Windows\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\{2AE55241-2870-4493-8034-ECE9534DE347}.exe
        
        C:\Windows\{2AE55241-2870-4493-8034-ECE9534DE347}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
        
        C:\Windows\{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
        
        C:\Windows\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
        
        C:\Windows\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F2B36~1.EXE > nul
        9⤵
        
        PID:2536
        
        C:\Windows\{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
        
        C:\Windows\{F412AC15-5652-439b-9244-EE4B631C3D87}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F412A~1.EXE > nul
        10⤵
        
        PID:2004
        
        C:\Windows\{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
        
        C:\Windows\{14EE025E-D0F7-4827-9A26-A6446A689685}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14EE0~1.EXE > nul
        11⤵
        
        PID:724
        
        C:\Windows\{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
        
        C:\Windows\{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{666BA~1.EXE > nul
        12⤵
        
        PID:1516
        
        C:\Windows\{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe
        
        C:\Windows\{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe
        12⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49C1A~1.EXE > nul
        8⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A6A1~1.EXE > nul
        7⤵
        
        PID:948
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2AE55~1.EXE > nul
        6⤵
        
        PID:1172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADC68~1.EXE > nul
        5⤵
        
        PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{13172~1.EXE > nul
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05DD4C31-0535-4266-8A29-B1FB3276C469}.exe

Filesize
408KB

MD5
a60aa5c6673a879bb30d0b9ac5dc80b5

SHA1
620478567fbf43cacd45e3a706c7904ddc2922c3

SHA256
7ced00e9ad7923e2c9d34d0cfe20c23c730580c9d85776e95ef23d6499005a05

SHA512
af96dd138fa91e6af2a1c27ebff30db27e2e421f2ddb6aec562cf8c66624822917d97a454f34f8745788de17628be47b4e8eeed3ce61219de30754f5537bbbf0

Download Submit
C:\Windows\{131727DC-D11F-4f3d-9DDD-C51F46E38935}.exe

Filesize
408KB

MD5
b787c9486b5fcb3f68d321cf8a9f4fac

SHA1
72c6fc5cdb782ab439908489950c6b98459be180

SHA256
e699f11202adfd2be0a3b8c0990638652bd16fc7fbb4485f9b5fe7f90a41525c

SHA512
0f2d3ab5c8a9ed551f0413e557ab254c0796d3cdc7a9ff9cf83c2b23ec7d4a6757dd7b8f1f1a261c08a4899ac073c0bad97833509010dc5d35b520053307e71c

Download Submit
C:\Windows\{14EE025E-D0F7-4827-9A26-A6446A689685}.exe

Filesize
408KB

MD5
08fd2bdf2603393724e5cd5a45c4f591

SHA1
ac83d7429f8fc09197ee4206dd2a5f33e7c29402

SHA256
f7a27cfc1f9cdd7e6eea2ea74037635d0575cbf6dd310e3b5b3dccb0bc003037

SHA512
10d50cf45c93b819a30e2b24a256ea198f4a1b74627b9ca3095ba9ee76b46102e1bbd31ca55015ffa7907c04f6305856c606d18e8e4b983724616b4ab70e1e4f

Download Submit
C:\Windows\{2AE55241-2870-4493-8034-ECE9534DE347}.exe

Filesize
408KB

MD5
23773c1c9d3a9d7bb54407b1a2c1afe2

SHA1
051db5ab02d2f478db92f15ad469ea11d980a968

SHA256
3043906586f67ce628a7c6752cc7199df9177f8b584e9171f4204690459791fa

SHA512
c7a70b69c5044604075603c1b03d775d5d771c7b91565e2a8e0be7d1174d5f9cf1cb1395cf48118a71374f93f56dcd0e54aad21a73b0df8fff9bae44a7bfb730

Download Submit
C:\Windows\{49C1ABCA-0FBF-411d-9AC4-BF2205CB4EAD}.exe

Filesize
408KB

MD5
f3de4bcc8e69a8504ad3b4c19f01f681

SHA1
4973f2106112c9bd7c0414c38c32896e12f2c6c2

SHA256
d65d9683eea107aee333040a84a8d26264ad4acb15503680ee6b4194f78b85e8

SHA512
e338754867b83970772ffe2af5f704b854f9580c5c01dbe318b71f300c768ced8fcd068d421448dff2ed1e5731145d54eba81c278ff4ceda889a809f214f2716

Download Submit
C:\Windows\{662CA401-2FF5-4a4c-8A1E-BF51CE6C420A}.exe

Filesize
408KB

MD5
5850445f060dca6a530cf92b877f00f3

SHA1
a88e67dbf1459ce5b5d130b854d096f326a45d7f

SHA256
845f64804b8f39b43e13953132e31eb6dcced165b7ccf3bfd52d80ed4199d8b0

SHA512
cad3353962ff2f8b2f78df1b6fdf2e3820f2011df8068347d8873ad473c6f570d77a3594ad18a859b06b769e4f3873e08e28231cde14d11d6e60254e77ff9939

Download Submit
C:\Windows\{666BAA9F-5521-4043-BC5B-0FC85C509534}.exe

Filesize
408KB

MD5
6ce89605b067bf91283b0f42ea51c185

SHA1
3a2ea910f170d431d15d89814bdc5a9e00452a83

SHA256
de4a8051d6ee0c4e3bc2f7182398b9e7b37d5e49d2a2228b439ffcd6d37940ea

SHA512
8df02f29c097aaf3d28c658860bea433327a1474c130b7fa624d93f6d4db554092f873bfa6379d2de8450c46f36b012b322b93194cf9d3c902723c4b67bd384c

Download Submit
C:\Windows\{9A6A1EB7-5798-42a3-963B-91D30531B233}.exe

Filesize
408KB

MD5
3cdd72a1c20f863d4fa126f904503311

SHA1
deede505cd7ba3817ead66c220197cc502e72b94

SHA256
0c7bd3592be482d5ec001d5265bdea354cc0518856ce96e244e07957d28a8fc8

SHA512
cd125c1dadee876df7870a7ee28de8d17c577671a7049316af3bb848e3e5536c8786c2425573a067c73e11b6263429535bc72c43a9489600a74072601de91f5c

Download Submit
C:\Windows\{ADC684E6-D404-48e9-A23D-32DB08A59B2F}.exe

Filesize
408KB

MD5
db42ec867e53c6145e9ae95f3c1601fd

SHA1
32727f2851939a12fef83c32ccd254acd9ecde72

SHA256
13b7243e1b2d71da6928456965492185253fda03d7dc33ecabe12f59dd4e4c37

SHA512
781ee6feb6d0f344c9206a2852dd3502098f04699ecb3736ede30050a22c31fdfd1fd1e1b38d2194250c5246bac89cebb038e1ca1d4b7b32199f40179e61edcf

Download Submit
C:\Windows\{F2B362DB-1D3A-4654-B2F2-47947FFB8609}.exe

Filesize
408KB

MD5
2087c1d5a86fbb39fce1848bfbce0cd2

SHA1
b1b6038106c4438781ae593032bbbb268da9ed89

SHA256
227200cb493b9579f1e0006896925064f890355c9618c5651368a7300a802e31

SHA512
66d2498dc394c999f8caa13e722ce742e368c26626e636a3c70290e2e76e094c301683fe52ec0ffe5d89bdb75168f2cdc447759b21dd0158ab7326a4878e221b

Download Submit
C:\Windows\{F412AC15-5652-439b-9244-EE4B631C3D87}.exe

Filesize
408KB

MD5
170086f6d7a93e7d2a70d6ab3dafe82e

SHA1
e2105d86563e9bcac0ae881dc80de6ec2486cae5

SHA256
c63be89a193b6c153584eede501005594352acbfe0eff3fe2b4f344c87c9bffb

SHA512
bfed09cdcefd47b94ab3096b5dc0e92b01b39967b1e1e0b39ef28db0492a24e5626c647a5a51df2a368ace59dcda8a1ba4eb9802a913322d4e2377ba32bf810d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads