c203b53db64585e905c7d5bc5052d42354f13986e7bcf8ed74517d772d941920

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe
Size

408KB
MD5

2563e407cd65a7faefe3fba3ecc3a6fe
SHA1

98b580703652634bdc412d48ad233481e1a200a0
SHA256

c203b53db64585e905c7d5bc5052d42354f13986e7bcf8ed74517d772d941920
SHA512

6a369aa60fc9a1e9b4ad826fa9885aff75446dc7a2307b91196d8a53b9149e401b1be1ee8465b31c81fca208bea6f24b20cc84829acbd754c73313500c03cb26
SSDEEP

3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000900000001222c-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012267-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000001222c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002900000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002a00000000b1f4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002b00000000b1f4-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002c00000000b1f4-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{67DB236E-44D7-4147-8A79-504E36B4F341}\stubpath = "C:\\Windows\\{67DB236E-44D7-4147-8A79-504E36B4F341}.exe"	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}\stubpath = "C:\\Windows\\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe"	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}\stubpath = "C:\\Windows\\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe"	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{862C8DCF-0F40-44e1-892C-92537E46358B}	{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{862C8DCF-0F40-44e1-892C-92537E46358B}\stubpath = "C:\\Windows\\{862C8DCF-0F40-44e1-892C-92537E46358B}.exe"	{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}	{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}\stubpath = "C:\\Windows\\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe"	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}	{577EFD16-7161-49cb-B567-0675259E9523}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}\stubpath = "C:\\Windows\\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe"	{577EFD16-7161-49cb-B567-0675259E9523}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}\stubpath = "C:\\Windows\\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe"	{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{67DB236E-44D7-4147-8A79-504E36B4F341}	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}\stubpath = "C:\\Windows\\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe"	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{577EFD16-7161-49cb-B567-0675259E9523}\stubpath = "C:\\Windows\\{577EFD16-7161-49cb-B567-0675259E9523}.exe"	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}\stubpath = "C:\\Windows\\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe"	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}\stubpath = "C:\\Windows\\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe"	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{577EFD16-7161-49cb-B567-0675259E9523}	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
1076	{577EFD16-7161-49cb-B567-0675259E9523}.exe
2584	{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
2100	{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
548	{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
File created	C:\Windows\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
File created	C:\Windows\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe	{577EFD16-7161-49cb-B567-0675259E9523}.exe
File created	C:\Windows\{862C8DCF-0F40-44e1-892C-92537E46358B}.exe	{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
File created	C:\Windows\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe	{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
File created	C:\Windows\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
File created	C:\Windows\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
File created	C:\Windows\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
File created	C:\Windows\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
File created	C:\Windows\{577EFD16-7161-49cb-B567-0675259E9523}.exe	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
File created	C:\Windows\{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
Token: SeIncBasePriorityPrivilege	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
Token: SeIncBasePriorityPrivilege	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
Token: SeIncBasePriorityPrivilege	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
Token: SeIncBasePriorityPrivilege	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
Token: SeIncBasePriorityPrivilege	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
Token: SeIncBasePriorityPrivilege	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
Token: SeIncBasePriorityPrivilege	1076	{577EFD16-7161-49cb-B567-0675259E9523}.exe
Token: SeIncBasePriorityPrivilege	2584	{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
Token: SeIncBasePriorityPrivilege	2100	{862C8DCF-0F40-44e1-892C-92537E46358B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2636	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	28
PID 620 wrote to memory of 2636	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	28
PID 620 wrote to memory of 2636	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	28
PID 620 wrote to memory of 2636	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	28
PID 620 wrote to memory of 2684	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	29
PID 620 wrote to memory of 2684	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	29
PID 620 wrote to memory of 2684	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	29
PID 620 wrote to memory of 2684	620	2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe	29
PID 2636 wrote to memory of 2096	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	30
PID 2636 wrote to memory of 2096	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	30
PID 2636 wrote to memory of 2096	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	30
PID 2636 wrote to memory of 2096	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	30
PID 2636 wrote to memory of 2740	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	31
PID 2636 wrote to memory of 2740	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	31
PID 2636 wrote to memory of 2740	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	31
PID 2636 wrote to memory of 2740	2636	{67DB236E-44D7-4147-8A79-504E36B4F341}.exe	31
PID 2096 wrote to memory of 2136	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	32
PID 2096 wrote to memory of 2136	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	32
PID 2096 wrote to memory of 2136	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	32
PID 2096 wrote to memory of 2136	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	32
PID 2096 wrote to memory of 2712	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	33
PID 2096 wrote to memory of 2712	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	33
PID 2096 wrote to memory of 2712	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	33
PID 2096 wrote to memory of 2712	2096	{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe	33
PID 2136 wrote to memory of 320	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	36
PID 2136 wrote to memory of 320	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	36
PID 2136 wrote to memory of 320	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	36
PID 2136 wrote to memory of 320	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	36
PID 2136 wrote to memory of 2932	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	37
PID 2136 wrote to memory of 2932	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	37
PID 2136 wrote to memory of 2932	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	37
PID 2136 wrote to memory of 2932	2136	{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe	37
PID 320 wrote to memory of 2988	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	39
PID 320 wrote to memory of 2988	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	39
PID 320 wrote to memory of 2988	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	39
PID 320 wrote to memory of 2988	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	39
PID 320 wrote to memory of 3056	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	38
PID 320 wrote to memory of 3056	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	38
PID 320 wrote to memory of 3056	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	38
PID 320 wrote to memory of 3056	320	{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe	38
PID 2988 wrote to memory of 2788	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	40
PID 2988 wrote to memory of 2788	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	40
PID 2988 wrote to memory of 2788	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	40
PID 2988 wrote to memory of 2788	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	40
PID 2988 wrote to memory of 2824	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	41
PID 2988 wrote to memory of 2824	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	41
PID 2988 wrote to memory of 2824	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	41
PID 2988 wrote to memory of 2824	2988	{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe	41
PID 2788 wrote to memory of 2144	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	42
PID 2788 wrote to memory of 2144	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	42
PID 2788 wrote to memory of 2144	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	42
PID 2788 wrote to memory of 2144	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	42
PID 2788 wrote to memory of 592	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	43
PID 2788 wrote to memory of 592	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	43
PID 2788 wrote to memory of 592	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	43
PID 2788 wrote to memory of 592	2788	{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe	43
PID 2144 wrote to memory of 1076	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	45
PID 2144 wrote to memory of 1076	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	45
PID 2144 wrote to memory of 1076	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	45
PID 2144 wrote to memory of 1076	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	45
PID 2144 wrote to memory of 1508	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	44
PID 2144 wrote to memory of 1508	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	44
PID 2144 wrote to memory of 1508	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	44
PID 2144 wrote to memory of 1508	2144	{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_2563e407cd65a7faefe3fba3ecc3a6fe_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
  C:\Windows\{67DB236E-44D7-4147-8A79-504E36B4F341}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
    C:\Windows\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
      C:\Windows\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
        
        C:\Windows\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:320
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7BAFA~1.EXE > nul
        6⤵
        
        PID:3056
      - C:\Windows\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
        
        C:\Windows\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
        
        C:\Windows\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
        
        C:\Windows\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D3A5F~1.EXE > nul
        9⤵
        
        PID:1508
        
        C:\Windows\{577EFD16-7161-49cb-B567-0675259E9523}.exe
        
        C:\Windows\{577EFD16-7161-49cb-B567-0675259E9523}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{577EF~1.EXE > nul
        10⤵
        
        PID:2296
        
        C:\Windows\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
        
        C:\Windows\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Windows\{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
        
        C:\Windows\{862C8DCF-0F40-44e1-892C-92537E46358B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe
        
        C:\Windows\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe
        12⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{862C8~1.EXE > nul
        12⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2B0A~1.EXE > nul
        11⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20CA1~1.EXE > nul
        8⤵
        
        PID:592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59D8E~1.EXE > nul
        7⤵
        
        PID:2824
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D8BF8~1.EXE > nul
        5⤵
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BACFD~1.EXE > nul
      4⤵
      PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{67DB2~1.EXE > nul
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{20CA1468-3824-4936-9E8F-B99E4C2C6A31}.exe

Filesize
408KB

MD5
115d710c503ab49713c786b23ad921e9

SHA1
96461796ce4d00326b27bc111d7d473c07ff2466

SHA256
252680eeece4a5a4e4734ecbcc2e7c6d2c8932616728251e80f204912868e134

SHA512
8792cb80e31a04988b98d137174a5cde0b860da9e4a23a4c486f76c61c508ef54ce49b4f41b878477aa889b22103ea72786b293eec5cc70470034284bdfdcf39

Download Submit
C:\Windows\{577EFD16-7161-49cb-B567-0675259E9523}.exe

Filesize
408KB

MD5
dcbefc5ff73a26698d3b7896bbfefd0f

SHA1
ff78e1b5e535896b4304bc8212c2f1f83cf1100f

SHA256
5e348a78aafa9400c48c3fba0b071a93384a68946a5923388af466fbe41de81f

SHA512
25e41a1086763de72867f20411ff7b3c556a0f6f6fdf709745c1a898657e36958c5e0dea72cea7054678d75a148282d4a9c1719fdf0db46caaa12f6ad17335aa

Download Submit
C:\Windows\{59D8E36A-0776-44f9-B13B-D1305F42B6D4}.exe

Filesize
408KB

MD5
8e2f751074f1263a5889f3ad5072f4f4

SHA1
3bdcfc9f1cd2adf0ab213fe4bda15a2032ffb92c

SHA256
5fff791a119418dea3a3bffb843c1377bfc7424bf5164702a199aab07846f8fb

SHA512
79f87255da75f5ce87f9a0774beba8f1532efaa0f22fcf76c8c1c6a0c0725eeb15001b61a6bf5544f8817cea8c8a3e9291c7e7e63c4ada893895273d5dfca96d

Download Submit
C:\Windows\{67DB236E-44D7-4147-8A79-504E36B4F341}.exe

Filesize
408KB

MD5
fb8f4db0e86aaf8e51f14fa99d8d7033

SHA1
5276dc4f655179ca411aec716440ec45dd9d5bd1

SHA256
e75c87f398f20c593a883436bc04aef7faebc7da7e198dfb1f1e32b3d5ba2797

SHA512
e0734e8115b8736a57fbdc1cb869307254a6b89621b71b05a468cbacf64ddde75aa368a09439c1bc5687f15577f2dbaf63cb8e2a98c2bc875164b5a92b1bb3b5

Download Submit
C:\Windows\{7BAFAFE1-A2FF-4b0c-AD7A-7907D97D8526}.exe

Filesize
408KB

MD5
244e7d121a1a4c7635ab7467413d5d3a

SHA1
5680329907fcc703e62c53b13e5942f05510f967

SHA256
97803943ed2382551dc46e737f6f39c69721941eac2812e17a8edd433099e900

SHA512
c40a66d2b32a58e38bae4753b0a84f0d6f40f9b55b2fb1676bf8fb46c51ad4f1bbaf998a66e4532bd19b0076fde8dff1acf4f4bd6252c5b5f3ed9e7e057e7048

Download Submit
C:\Windows\{862C8DCF-0F40-44e1-892C-92537E46358B}.exe

Filesize
408KB

MD5
1e4ad43a054db170d8d08b5c94ce4536

SHA1
558324c27f28af58c37a663698e54a9f6f167d67

SHA256
c18df84ad3e61ebcb44f3f9098b7b4aeff9eb0e0c11ccf733603bdcd57704508

SHA512
afdcdbdfb761a059897488c4aa6fbffec494f41ee71963a727a865c94b03cdeb8fd6c66690a627370aa7bf8f6ccd880af2c3d11cbeffe485c07ff9ad6b1d8c4c

Download Submit
C:\Windows\{A2B0A530-654B-417c-B91F-52FFA2D39DA4}.exe

Filesize
408KB

MD5
23fb6312bf4442924e59c3c277a8e1db

SHA1
12ccd67cde5330bbcf69d091a1972971e5a00e29

SHA256
917e75ef4cc2e4705dbe9e711bc8534f1cecf5489b28c18e109a3f5b0f002aed

SHA512
ebf8bcad16ae800826ffe81791abaf221508a0f49839501aa97e3df574a38af724cb4fabbe34b252fd15b1efac26369f81c76b2a3c93bb3280cc9ef83a8d2bb0

Download Submit
C:\Windows\{B92B4F7A-6BE3-46e5-AE2D-B8DAB61D3D5C}.exe

Filesize
408KB

MD5
69edf7b11bb9773ac85535b5cf573905

SHA1
cb7c4b89d77e50b6e2fa037de75a6a5c5820f658

SHA256
4ff82dfbdbb6ff24349592cce4edd38995149b3e3d9ab064042c742a7a027ba2

SHA512
4d64ccb97f69488e67478ef26029c88603de54a4bbaa19bd4bd720b03a14f5253b8fc0df2adfa4608b91bdbd36f4cc1a659efcbbd2bfb10be8c762126f778d21

Download Submit
C:\Windows\{BACFD1E4-C1AC-450f-8FCE-8E6AA8E0BEDA}.exe

Filesize
408KB

MD5
6e0adc2474d43008cb88ea6e9e9c9181

SHA1
86552a436929063651c4225e342d292f88462c77

SHA256
423230ad1c73a8fefcff2462b800c4fdf239e876168dcc0509b4bf1f677cc3aa

SHA512
3a050befa57792356215cc3ab860dc2770288954645d324e0b5b694453f6ff8a71c738e7e304d841e93625cbb78721ce0bf951bcf0846d9e0a2b103ec884235f

Download Submit
C:\Windows\{D3A5FBDE-F6B3-4739-84AE-6CC17BF0980F}.exe

Filesize
408KB

MD5
4e3765018729c843870f6b4b82256c15

SHA1
0cdc19e67f83bd8c9f2f39807aa4bf0d53dca2c0

SHA256
812ccd700443cb0ab8259aaa6ff4954c153d17bde7af53b23106ba931a25b450

SHA512
98c443aa5adb7530ef4d804d6873e6b2d816216f36393fad1be93ec8e9942e52da072dfb694d8f3f4f9ac69c5f2bc024f1c5b5f22b7ce91dd02166c1c9098026

Download Submit
C:\Windows\{D8BF8C5E-9248-446f-B6F3-8B5757F70FF1}.exe

Filesize
408KB

MD5
ed5b315b20eb3d325f74ddeb061664b7

SHA1
c70f47e95c5e5a2e609e0c758cc4f4849b79556a

SHA256
f28fb9b7417ddd5739c5fdacbc524681b0fe4c8811b50d0fd387f8eb3108920d

SHA512
746668f81d54d8e9ae763fc91111f670f90ee9fda4b0b035c02f47834531004b54e2d015972510aac4ea87de08949f61c1c74e4bf9d0c18c6ff59f2375073f0c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads