ead1c1be9af8396f66fd161f2c91b07c542d9174df516327fa7a1aeff1b60e3c

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
Size

408KB
MD5

ebde00a8d2cb913906981af18ef09ec1
SHA1

cc8bc14d768772428701970d5f13ccf4af650e0d
SHA256

ead1c1be9af8396f66fd161f2c91b07c542d9174df516327fa7a1aeff1b60e3c
SHA512

6ecff9d22abce2fedf0b52156b9c39bc57fb69271ffb213c80a5405568c31a3147d6b83db23e7d6e49794d2a5ba13269325db3b50da50ff7a3cb70e24eb57ad7
SSDEEP

3072:CEGh0oUl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGuldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122bf-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c85-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000122bf-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015cd9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a0000000122bf-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122bf-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122bf-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2F957002-5629-4579-9701-5CF09A563DA3}	{1283511B-D567-4780-B0E9-0921C2596922}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}\stubpath = "C:\\Windows\\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe"	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}	{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}	{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8D29713-3036-4845-920A-781C0C9E35E4}	{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8D29713-3036-4845-920A-781C0C9E35E4}\stubpath = "C:\\Windows\\{C8D29713-3036-4845-920A-781C0C9E35E4}.exe"	{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8874D800-1955-44a6-877A-2E810B536C65}	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}\stubpath = "C:\\Windows\\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe"	{8874D800-1955-44a6-877A-2E810B536C65}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1283511B-D567-4780-B0E9-0921C2596922}	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2F957002-5629-4579-9701-5CF09A563DA3}\stubpath = "C:\\Windows\\{2F957002-5629-4579-9701-5CF09A563DA3}.exe"	{1283511B-D567-4780-B0E9-0921C2596922}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}	{2F957002-5629-4579-9701-5CF09A563DA3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F4EDC9-023C-491d-BCAD-1178A42B0101}	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F4EDC9-023C-491d-BCAD-1178A42B0101}\stubpath = "C:\\Windows\\{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe"	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}\stubpath = "C:\\Windows\\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe"	{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8874D800-1955-44a6-877A-2E810B536C65}\stubpath = "C:\\Windows\\{8874D800-1955-44a6-877A-2E810B536C65}.exe"	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}\stubpath = "C:\\Windows\\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe"	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}	{8874D800-1955-44a6-877A-2E810B536C65}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1283511B-D567-4780-B0E9-0921C2596922}\stubpath = "C:\\Windows\\{1283511B-D567-4780-B0E9-0921C2596922}.exe"	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}\stubpath = "C:\\Windows\\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe"	{2F957002-5629-4579-9701-5CF09A563DA3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}\stubpath = "C:\\Windows\\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe"	{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe

Deletes itself 1 IoCs

pid	Process
856	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe
2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe
2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe
1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
1720	{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
2772	{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
596	{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
2116	{C8D29713-3036-4845-920A-781C0C9E35E4}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{8874D800-1955-44a6-877A-2E810B536C65}.exe	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
File created	C:\Windows\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	{8874D800-1955-44a6-877A-2E810B536C65}.exe
File created	C:\Windows\{2F957002-5629-4579-9701-5CF09A563DA3}.exe	{1283511B-D567-4780-B0E9-0921C2596922}.exe
File created	C:\Windows\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe	{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
File created	C:\Windows\{C8D29713-3036-4845-920A-781C0C9E35E4}.exe	{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
File created	C:\Windows\{1283511B-D567-4780-B0E9-0921C2596922}.exe	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
File created	C:\Windows\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	{2F957002-5629-4579-9701-5CF09A563DA3}.exe
File created	C:\Windows\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
File created	C:\Windows\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
File created	C:\Windows\{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
File created	C:\Windows\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe	{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe
Token: SeIncBasePriorityPrivilege	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
Token: SeIncBasePriorityPrivilege	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe
Token: SeIncBasePriorityPrivilege	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe
Token: SeIncBasePriorityPrivilege	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
Token: SeIncBasePriorityPrivilege	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
Token: SeIncBasePriorityPrivilege	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
Token: SeIncBasePriorityPrivilege	1720	{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
Token: SeIncBasePriorityPrivilege	2772	{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
Token: SeIncBasePriorityPrivilege	596	{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1336	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	28
PID 2272 wrote to memory of 1336	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	28
PID 2272 wrote to memory of 1336	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	28
PID 2272 wrote to memory of 1336	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	28
PID 2272 wrote to memory of 856	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	29
PID 2272 wrote to memory of 856	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	29
PID 2272 wrote to memory of 856	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	29
PID 2272 wrote to memory of 856	2272	2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe	29
PID 1336 wrote to memory of 2548	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	30
PID 1336 wrote to memory of 2548	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	30
PID 1336 wrote to memory of 2548	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	30
PID 1336 wrote to memory of 2548	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	30
PID 1336 wrote to memory of 2608	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	31
PID 1336 wrote to memory of 2608	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	31
PID 1336 wrote to memory of 2608	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	31
PID 1336 wrote to memory of 2608	1336	{8874D800-1955-44a6-877A-2E810B536C65}.exe	31
PID 2548 wrote to memory of 2668	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	33
PID 2548 wrote to memory of 2668	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	33
PID 2548 wrote to memory of 2668	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	33
PID 2548 wrote to memory of 2668	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	33
PID 2548 wrote to memory of 2876	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	32
PID 2548 wrote to memory of 2876	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	32
PID 2548 wrote to memory of 2876	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	32
PID 2548 wrote to memory of 2876	2548	{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe	32
PID 2668 wrote to memory of 2440	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	36
PID 2668 wrote to memory of 2440	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	36
PID 2668 wrote to memory of 2440	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	36
PID 2668 wrote to memory of 2440	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	36
PID 2668 wrote to memory of 1036	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	37
PID 2668 wrote to memory of 1036	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	37
PID 2668 wrote to memory of 1036	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	37
PID 2668 wrote to memory of 1036	2668	{1283511B-D567-4780-B0E9-0921C2596922}.exe	37
PID 2440 wrote to memory of 1832	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	39
PID 2440 wrote to memory of 1832	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	39
PID 2440 wrote to memory of 1832	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	39
PID 2440 wrote to memory of 1832	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	39
PID 2440 wrote to memory of 1892	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	38
PID 2440 wrote to memory of 1892	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	38
PID 2440 wrote to memory of 1892	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	38
PID 2440 wrote to memory of 1892	2440	{2F957002-5629-4579-9701-5CF09A563DA3}.exe	38
PID 1832 wrote to memory of 2304	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	41
PID 1832 wrote to memory of 2304	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	41
PID 1832 wrote to memory of 2304	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	41
PID 1832 wrote to memory of 2304	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	41
PID 1832 wrote to memory of 1284	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	40
PID 1832 wrote to memory of 1284	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	40
PID 1832 wrote to memory of 1284	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	40
PID 1832 wrote to memory of 1284	1832	{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe	40
PID 2304 wrote to memory of 2004	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	42
PID 2304 wrote to memory of 2004	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	42
PID 2304 wrote to memory of 2004	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	42
PID 2304 wrote to memory of 2004	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	42
PID 2304 wrote to memory of 2040	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	43
PID 2304 wrote to memory of 2040	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	43
PID 2304 wrote to memory of 2040	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	43
PID 2304 wrote to memory of 2040	2304	{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe	43
PID 2004 wrote to memory of 1720	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	44
PID 2004 wrote to memory of 1720	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	44
PID 2004 wrote to memory of 1720	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	44
PID 2004 wrote to memory of 1720	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	44
PID 2004 wrote to memory of 828	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	45
PID 2004 wrote to memory of 828	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	45
PID 2004 wrote to memory of 828	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	45
PID 2004 wrote to memory of 828	2004	{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_ebde00a8d2cb913906981af18ef09ec1_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\{8874D800-1955-44a6-877A-2E810B536C65}.exe
  C:\Windows\{8874D800-1955-44a6-877A-2E810B536C65}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
    C:\Windows\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{54C44~1.EXE > nul
      4⤵
      PID:2876
  - - C:\Windows\{1283511B-D567-4780-B0E9-0921C2596922}.exe
      C:\Windows\{1283511B-D567-4780-B0E9-0921C2596922}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Windows\{2F957002-5629-4579-9701-5CF09A563DA3}.exe
        
        C:\Windows\{2F957002-5629-4579-9701-5CF09A563DA3}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2F957~1.EXE > nul
        6⤵
        
        PID:1892
      - C:\Windows\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
        
        C:\Windows\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1BB3~1.EXE > nul
        7⤵
        
        PID:1284
        
        C:\Windows\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
        
        C:\Windows\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
        
        C:\Windows\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
        
        C:\Windows\{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
        
        C:\Windows\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
        
        C:\Windows\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
        
        C:\Windows\{C8D29713-3036-4845-920A-781C0C9E35E4}.exe
        
        C:\Windows\{C8D29713-3036-4845-920A-781C0C9E35E4}.exe
        12⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7E0D~1.EXE > nul
        12⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32384~1.EXE > nul
        11⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12F4E~1.EXE > nul
        10⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14F9B~1.EXE > nul
        9⤵
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7640~1.EXE > nul
        8⤵
        
        PID:2040
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12835~1.EXE > nul
        5⤵
        
        PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8874D~1.EXE > nul
    3⤵
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1283511B-D567-4780-B0E9-0921C2596922}.exe

Filesize
408KB

MD5
89f997f06e9487f5dc7308dc5e2d6d27

SHA1
86743e017e0eca9d298328f1522ce495446385f3

SHA256
567cc258e7f5072956bcf7203ec143088bc1ef68dcaea0d9e9b47470cabd2e54

SHA512
26c0d17943853dac3133afc9c5c8da964450d74af64b04c18bc48bdd6e890bd2e5ee93794a06d1ec8b28173cb1b84ef434313c3dcae08489225f0939350c8b74

Download Submit
C:\Windows\{12F4EDC9-023C-491d-BCAD-1178A42B0101}.exe

Filesize
408KB

MD5
f14826d7f1634c1c9ab6dec5eb862c86

SHA1
58b11a53b0dfbe6b8ad72eb121a72c10c96c6f8c

SHA256
858ec342ce311602ab732b699848099cb21fb2466a982a0328493d9fe9698a48

SHA512
3e679f2003913930f97152830e744ef665520e2d9ce135656d9a7a799ea1c84d12093f6281749f8f30bd9aa32345b65618fb8332f85edd386bb0f33a087ad436

Download Submit
C:\Windows\{14F9BD33-03CD-4803-B8BD-EDFE09F9660A}.exe

Filesize
408KB

MD5
e612c825c113f530f9992138c8c0f724

SHA1
49233daa2fb9a5be3e04100de3c4206a0ee3e814

SHA256
475daf5c8fb38a1a59e301a1b072a4fa3eb029301f249839a347baaf2bdba8c2

SHA512
1272398b151562e3ffb0a75191b600558859c03b230b36cc568cc9ded22f301dee017849057ea849f11de3ac16c03e010770e977ff7732d09e41be289b24878e

Download Submit
C:\Windows\{2F957002-5629-4579-9701-5CF09A563DA3}.exe

Filesize
408KB

MD5
68804d87daabe20169cd638d14164740

SHA1
d7125b6f4f50cc06dadc09b2bc61c74c40ceb432

SHA256
16dad3c1c1070d7182dd56fa794495ab736d0e9de7d45559c7c47a2948d7f5f1

SHA512
17127baed9d14c3448abfba480f30f2ee222ef71d0064901bac4b7f8e2942b20f0c2cf1b2fd15a9cecdae0f172688229076ad54a5164b6689a7d1fc2d43e5a98

Download Submit
C:\Windows\{32384B71-2A01-46e5-9EAA-E4F8DDBC5B1F}.exe

Filesize
408KB

MD5
a8a4ecee45cced84dc4753008bc7bebf

SHA1
c77f3eea3350eed7320a7271510b88ba065ab73a

SHA256
1b96a92659602f887e3719200a3ecf44b2cc9ee47b661fada5cf7ed645c102ff

SHA512
1c2021337d159cb100bccb6c60a3bd7ba3d7a30579f0902f7ce63804ba742ff1d9b71bf79dfba5841a9c18fa4a06ded5591eca7c8ceeae3f5de030636fe60a93

Download Submit
C:\Windows\{54C44DEC-1B08-416c-B3C6-6FAAE124B1FE}.exe

Filesize
408KB

MD5
d6dacd1340166793b0e58b84dc501cf0

SHA1
9bb6fbf020e5a18e16d3aca9792ed6a7886fa478

SHA256
0d558393af234703c43eaecc6032cd500ae8f84a8b1989587a22ce5230403936

SHA512
660ae7ced648305bc23f2a0f56cc012dc2e4d8b73feef3aa161db4c7861793c45a0fa15afd36e30fe90e9a9abcb3a3bf246fffbdbc5a1aa5f843736e4a9058ee

Download Submit
C:\Windows\{8874D800-1955-44a6-877A-2E810B536C65}.exe

Filesize
408KB

MD5
b33647f01eea606c52e6fd520c128e74

SHA1
606d86835fd8edfd99fe1fa6f45f828db875e8a8

SHA256
4cd28a54cb270ed0d7aa563d097d2ae1367e5eefe5ad9b374df459ead9710f13

SHA512
287ef567dc12b8e848404a163161976d42c4a6f2af0823422c3e43f022ebb52ce98f5edbfeaa95d938fe8b7159d9178d175f41833622c5aac38e445cd3a40c77

Download Submit
C:\Windows\{C7E0D100-354D-43c7-B1C0-3B4CD4C94335}.exe

Filesize
408KB

MD5
cefc5d5ce0854911eba123d5bc063e54

SHA1
82878d6fbe2f8fb1024f403bd478eacd8513e585

SHA256
0c19b7300765bf8fa1ea715e62c2ba900fa854e5e77a1b07cfea0940270f54f3

SHA512
0b4e39a155bebc6e00ce126776427f4aa3b8c48296c502807ab47ae7b041d9b7f942eb29f22437155343c918e3e6a9893aaa7ea6033cef9ebe5f445a66804369

Download Submit
C:\Windows\{C8D29713-3036-4845-920A-781C0C9E35E4}.exe

Filesize
408KB

MD5
a6e9d69cf32a1bffbddc916e71a21e5e

SHA1
3adf8d526d0dbba01b42e406f7ac89b0f3710cea

SHA256
6510facaaa41882fa78ce6eb5bfc651646c8f537b30c5cca0eec25ecab0cd47f

SHA512
89deb7686140555e6b2234e6e221647bbcf2fc0e11aa43d7935a4e5e5b66fba32ce396d5003fdb71fed1661338267be14402e3127f83cb12bde3110e764c2071

Download Submit
C:\Windows\{E1BB3A7E-42A3-4d42-9921-5F46A81279A7}.exe

Filesize
408KB

MD5
f9b8587222db3e3983e41651c6988055

SHA1
9a0dff7a56e4ecbb5d740446de7d1d6d9260b2f9

SHA256
d1eafb214a8cbc6d60c7055e04cdde4409ddd600f7febcaceeb88d8b6b84cd7e

SHA512
efd45f799b985585660fc1e0d99a71ef0859ad4b045b4efe36bd5553c6854597ffc725ada271b327111aae9334bddfd94cba4c2a231c5da535643fd6096841d5

Download Submit
C:\Windows\{E7640DD2-9220-438a-A21B-EC7B955D5CAB}.exe

Filesize
408KB

MD5
e4843f769193bd0352d87672a0882682

SHA1
52e2a06ce03737457be4adc0bfc796b5c201db9e

SHA256
d35289c32ef3676dd13e8be65909ac6fba691af5c11be71b7b1a27e1fa56a5ac

SHA512
7114a76c7343920f9998db665c8d5e445aeb96a9b52443e9d7bfda1056568bf917cd4917bddec5fb04965bd08e4aa944b98eb95ff55df89e752a7cf38cb61199

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads