94bd55ec9ea2e4ab56d004c09162835b99016a924f7d3cf197115fe6c26fd3fc

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
Size

180KB
MD5

8346cc1ff7610685707d513db3841e91
SHA1

4f3eb52da5d9d96e5fef79e8e3ab6db5e6a2573a
SHA256

94bd55ec9ea2e4ab56d004c09162835b99016a924f7d3cf197115fe6c26fd3fc
SHA512

129801e1b3a53e44f9a64d8a4dddb93bbd623853a5e5bd1e4143fd1f45606d0d094dcd1aa7f56fa51c1804448a6772b02d6c541e37e7b63de3f78239865d8172
SSDEEP

3072:jEGh0oDlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGxl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012240-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000001445e-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001445e-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001445e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000f680-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001445e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000f680-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001445e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001300000000f680-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}	{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}\stubpath = "C:\\Windows\\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe"	{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}\stubpath = "C:\\Windows\\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe"	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}\stubpath = "C:\\Windows\\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe"	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}	{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A01F0931-E65E-4661-87EA-FB62626FE844}\stubpath = "C:\\Windows\\{A01F0931-E65E-4661-87EA-FB62626FE844}.exe"	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}\stubpath = "C:\\Windows\\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe"	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86AB184C-C280-4cd4-84B2-526A7D03920B}\stubpath = "C:\\Windows\\{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe"	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}\stubpath = "C:\\Windows\\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe"	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43CC76E3-5F06-4903-B3B1-B231BA32940C}	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CA259EF-C286-410f-95EC-2480BDC7DF06}	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A01F0931-E65E-4661-87EA-FB62626FE844}	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86AB184C-C280-4cd4-84B2-526A7D03920B}	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}\stubpath = "C:\\Windows\\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe"	{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}\stubpath = "C:\\Windows\\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe"	{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43CC76E3-5F06-4903-B3B1-B231BA32940C}\stubpath = "C:\\Windows\\{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe"	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8CA259EF-C286-410f-95EC-2480BDC7DF06}\stubpath = "C:\\Windows\\{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe"	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}	{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe

Deletes itself 1 IoCs

pid	Process
2488	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
1528	{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
612	{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
2756	{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe
2240	{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
File created	C:\Windows\{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
File created	C:\Windows\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
File created	C:\Windows\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
File created	C:\Windows\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe	{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
File created	C:\Windows\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe	{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
File created	C:\Windows\{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
File created	C:\Windows\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
File created	C:\Windows\{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
File created	C:\Windows\{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
File created	C:\Windows\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe	{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
Token: SeIncBasePriorityPrivilege	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
Token: SeIncBasePriorityPrivilege	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
Token: SeIncBasePriorityPrivilege	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
Token: SeIncBasePriorityPrivilege	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
Token: SeIncBasePriorityPrivilege	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
Token: SeIncBasePriorityPrivilege	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
Token: SeIncBasePriorityPrivilege	1528	{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
Token: SeIncBasePriorityPrivilege	612	{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
Token: SeIncBasePriorityPrivilege	2756	{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2472	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	28
PID 2256 wrote to memory of 2472	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	28
PID 2256 wrote to memory of 2472	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	28
PID 2256 wrote to memory of 2472	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	28
PID 2256 wrote to memory of 2488	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	29
PID 2256 wrote to memory of 2488	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	29
PID 2256 wrote to memory of 2488	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	29
PID 2256 wrote to memory of 2488	2256	2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe	29
PID 2472 wrote to memory of 2404	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	32
PID 2472 wrote to memory of 2404	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	32
PID 2472 wrote to memory of 2404	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	32
PID 2472 wrote to memory of 2404	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	32
PID 2472 wrote to memory of 2556	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	33
PID 2472 wrote to memory of 2556	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	33
PID 2472 wrote to memory of 2556	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	33
PID 2472 wrote to memory of 2556	2472	{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe	33
PID 2404 wrote to memory of 2444	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	34
PID 2404 wrote to memory of 2444	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	34
PID 2404 wrote to memory of 2444	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	34
PID 2404 wrote to memory of 2444	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	34
PID 2404 wrote to memory of 2820	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	35
PID 2404 wrote to memory of 2820	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	35
PID 2404 wrote to memory of 2820	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	35
PID 2404 wrote to memory of 2820	2404	{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe	35
PID 2444 wrote to memory of 2364	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	36
PID 2444 wrote to memory of 2364	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	36
PID 2444 wrote to memory of 2364	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	36
PID 2444 wrote to memory of 2364	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	36
PID 2444 wrote to memory of 556	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	37
PID 2444 wrote to memory of 556	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	37
PID 2444 wrote to memory of 556	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	37
PID 2444 wrote to memory of 556	2444	{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe	37
PID 2364 wrote to memory of 1184	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	38
PID 2364 wrote to memory of 1184	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	38
PID 2364 wrote to memory of 1184	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	38
PID 2364 wrote to memory of 1184	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	38
PID 2364 wrote to memory of 2656	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	39
PID 2364 wrote to memory of 2656	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	39
PID 2364 wrote to memory of 2656	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	39
PID 2364 wrote to memory of 2656	2364	{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe	39
PID 1184 wrote to memory of 2804	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	40
PID 1184 wrote to memory of 2804	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	40
PID 1184 wrote to memory of 2804	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	40
PID 1184 wrote to memory of 2804	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	40
PID 1184 wrote to memory of 2916	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	41
PID 1184 wrote to memory of 2916	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	41
PID 1184 wrote to memory of 2916	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	41
PID 1184 wrote to memory of 2916	1184	{A01F0931-E65E-4661-87EA-FB62626FE844}.exe	41
PID 2804 wrote to memory of 1912	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	42
PID 2804 wrote to memory of 1912	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	42
PID 2804 wrote to memory of 1912	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	42
PID 2804 wrote to memory of 1912	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	42
PID 2804 wrote to memory of 2284	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	43
PID 2804 wrote to memory of 2284	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	43
PID 2804 wrote to memory of 2284	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	43
PID 2804 wrote to memory of 2284	2804	{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe	43
PID 1912 wrote to memory of 1528	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	44
PID 1912 wrote to memory of 1528	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	44
PID 1912 wrote to memory of 1528	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	44
PID 1912 wrote to memory of 1528	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	44
PID 1912 wrote to memory of 1624	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	45
PID 1912 wrote to memory of 1624	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	45
PID 1912 wrote to memory of 1624	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	45
PID 1912 wrote to memory of 1624	1912	{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_8346cc1ff7610685707d513db3841e91_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
  C:\Windows\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
    C:\Windows\{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
      C:\Windows\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
        
        C:\Windows\{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
        
        C:\Windows\{A01F0931-E65E-4661-87EA-FB62626FE844}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
        
        C:\Windows\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
        
        C:\Windows\{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
        
        C:\Windows\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
        
        C:\Windows\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
        
        C:\Windows\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe
        
        C:\Windows\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe
        
        C:\Windows\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe
        12⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB181~1.EXE > nul
        12⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{540DA~1.EXE > nul
        11⤵
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2EEFF~1.EXE > nul
        10⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{86AB1~1.EXE > nul
        9⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F0479~1.EXE > nul
        8⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A01F0~1.EXE > nul
        7⤵
        
        PID:2916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8CA25~1.EXE > nul
        6⤵
        
        PID:2656
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6570E~1.EXE > nul
        5⤵
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{43CC7~1.EXE > nul
      4⤵
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FDCAF~1.EXE > nul
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2EEFFD5C-3FB8-4c2e-8E5E-B29A54CCECB0}.exe

Filesize
180KB

MD5
1d295a7e2d0e7c7c378eaa0b235041c7

SHA1
f7b8a7e25e673b18ef21c892117f2fe9b2064f47

SHA256
a7756138c8e600251a62039099192595e8baacd68dc6bf4aa36d66fd90cdf6d3

SHA512
c097861030e00ad020d2c9f97123bef02859003f77b2e617f4957d0199c4a6dfdae48390a513d28fab4a70c2912503c6de69652101de8cb81455d8f316a41300

Download Submit
C:\Windows\{43CC76E3-5F06-4903-B3B1-B231BA32940C}.exe

Filesize
180KB

MD5
7ba9a10515c23b5ec32939a081026a76

SHA1
6e78d2728f03040d3ff4457ebea4560df7d9ba8e

SHA256
6a10ad65233fa460b8e476802081632befab06a14e3ec809df34ffd17875cea9

SHA512
f0f70697da9bb6d3bece89183f65665c56f1f950124abce07bb8c12bacfe23191f13d47498a5bfca9e10b69ced129be9432531aa912d254032e75b2ffac032f3

Download Submit
C:\Windows\{540DA734-7E7F-49aa-9662-EBBBAFE4D977}.exe

Filesize
180KB

MD5
6fb676968bdd9dbc1551b93ce74ea8c8

SHA1
eca80d744e1ac7acdfc28e25cba4c814db43b8e6

SHA256
df24351bc01225742fe04c772ee1dda0099406ca27674c458b7cbe827c409d5f

SHA512
90d308ecdacbda4ac17743f1a6e5a6bee4606b5c7ad40b506b32dfb1cccb62deb6887036121ac3d3d0c70c88bfc959c00d793f38babbd9a38102f65bf7551a94

Download Submit
C:\Windows\{6570E9ED-A1B0-46f5-9E3D-F47229801F3B}.exe

Filesize
180KB

MD5
ce2d73c1f2474d8a177988fb67186536

SHA1
ea55444acde5bf1f24a93b39c1504380c23fb170

SHA256
b50d57979aa3cf449a4964f161a74fc9f3c26d19ebfa02331811488a7379e6d9

SHA512
7c62bed1909f9ee842f7eede540e488a335b0c6f167a3f608a3d5ff9734f625db8e9e886586ded86fc9c3e5ed7a67abc66e053cc888c5b1a343a88691ff778a6

Download Submit
C:\Windows\{86AB184C-C280-4cd4-84B2-526A7D03920B}.exe

Filesize
180KB

MD5
38d8e236061a30158a587eff0d0f0420

SHA1
9f50172503a2cb96efbdeb9e4ed6b0dc264a4e7d

SHA256
6b19bc07551aca6c0dd1cdd3858efe2a82a8e2c66a6f38e5716e44fddbb14bc0

SHA512
e41ac77af5acf044bb257bd211d30f5d69a3af764055345d5ec4733f9b844afae2bbdb788aa72d1ce2424070014de364b527263161a0eeb04266a2f89e591185

Download Submit
C:\Windows\{8CA259EF-C286-410f-95EC-2480BDC7DF06}.exe

Filesize
180KB

MD5
dfd429713406886e500c91fa7da33a8b

SHA1
a87ba4793332843589379f471fc91239397cfc5b

SHA256
0a6dc3a31d262b1fd47329d8ef5d937905afe6b0c1af8da3473eb25afb7f1318

SHA512
3801ec3c67eb882d5e902e3013f96d5d4b1c0120dfa81b7d3fa313e9d6bc30c50ee669ef13dbcae97ffdc5aea1f8080906bb50563c8a6996d0f2a5ae08708c24

Download Submit
C:\Windows\{A01F0931-E65E-4661-87EA-FB62626FE844}.exe

Filesize
180KB

MD5
0b321e73b4ba4970f529bb3573d7feb6

SHA1
a545c0f4ad48067125a2245505482120239a85b3

SHA256
9b8fb747c7b4bf0a57daf1daad20b68e247551a8ac4e10d3995abb36d8ba7159

SHA512
7c145f77d2977e7bda86ec90e410a94098283eb831a9b2b9606d6ff31b6163499fdb49adea4fff21bb231b3d51e034179ebad4e4b7156da1bf66d1f1f695d58f

Download Submit
C:\Windows\{CCFFD642-B964-4f8b-98C9-50E94F67E0E4}.exe

Filesize
180KB

MD5
c49114190756d029f40f15d6c573a34a

SHA1
95e7dbe9ec1d6fb88320fc0896cca77e6e4ef7d5

SHA256
d2a2058e7cd08d80a06d8589006b06ba4d352d7a725e51d7609cea785e75aa7b

SHA512
dfad2e394bbc42ddaa5001b633a3a558811124f928cffcb51b423f9edebd4b186293dadf11fa612421f819f3f4390bcbd799184ee77982d4e9d687677c312d2b

Download Submit
C:\Windows\{F0479AE8-EB72-4d07-B3B3-68900061DC0D}.exe

Filesize
180KB

MD5
ac259e96aa8c63703eb4f0161d00b179

SHA1
1399c16a4f003c17edf1d45747cca1a40187abb3

SHA256
0d5f7ce28d833d803a4b15b5fe25031b523372600f8ce9dd645a1d29108402e3

SHA512
6fd1292a3a4472f116a08509b4cde6c9f498e5808e7118aaf2647177ae995e25ea547fa7d926dbf5d6f079a5783a9b5e7341e064cf3d4b50d75e6ea041666dc1

Download Submit
C:\Windows\{FB181F18-4172-4b98-B414-EC7D28CD0EBE}.exe

Filesize
180KB

MD5
7bc1abcc2c7a55e2a8eb4bd32492b0a4

SHA1
753a1ffbd1a80b5b8fa1909c23f6fbaf938e86ad

SHA256
135ee78e2aa008ca07e2303f6c4ff747fe68594894134c55f36651fc77cd9519

SHA512
e925b5d53ed1ba590348dfd7d4ba807c548bae0d9daa79226bd06ec0adf48034dd81728eed0bcdf1911ec21bd4bd45098a147dcc7fb3f2ea4fcf0ad4ee61d1f3

Download Submit
C:\Windows\{FDCAF76D-E948-4ba6-9E9C-B4CF42628708}.exe

Filesize
180KB

MD5
509e7441259212c34fd230e80ac8d87a

SHA1
330c5ed450cc3d33fcc5fc25665a7b07d717093d

SHA256
4cfeff2e0bf31ce42b3f28e9f35163ed445bbba50cf0bc19a1a86c979943f8a2

SHA512
15d2e576df8ee902108bf3b96f1745079e8b19ac04eb25cc309c6271d29f96447a64b41edc8d66d7827cb21d68c6b80895f7743eaf9de1d8a1fc77dc9b19d239

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads