4ebf7ebf8d69d2f4f266f12424424acc8e876b6f0cc5697137f205a0e9aae6fc

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Size

344KB
MD5

9d2c783cb14279201d52177459fe9b69
SHA1

343287523da81b036d0c67e144532dbe6e7b29e4
SHA256

4ebf7ebf8d69d2f4f266f12424424acc8e876b6f0cc5697137f205a0e9aae6fc
SHA512

3a4f09184b9bb8746d01216d38f41d3d3f5bd912eb18d43913daa8d5fb8a5c8b9bb18731224f9d8d32d546083e2fafe5fedb39286fc574a3f76363dd9235d355
SSDEEP

3072:mEGh0oBlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGflqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012226-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015c73-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002500000000b1f4-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed8-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002600000000b1f4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed8-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002700000000b1f4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed8-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002800000000b1f4-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed8-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002900000000b1f4-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{74AFE3DB-BEAE-4207-A19E-4A6715422655}	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}\stubpath = "C:\\Windows\\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe"	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14A14FC4-0568-42c9-9664-05134641DAC0}\stubpath = "C:\\Windows\\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe"	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}	{37078090-3677-4ac6-B901-A119067EA396}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14A14FC4-0568-42c9-9664-05134641DAC0}	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}\stubpath = "C:\\Windows\\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe"	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37078090-3677-4ac6-B901-A119067EA396}	{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}	{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3CF346A-2539-40f5-8782-C944F40E3354}	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3CF346A-2539-40f5-8782-C944F40E3354}\stubpath = "C:\\Windows\\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe"	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}\stubpath = "C:\\Windows\\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe"	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}\stubpath = "C:\\Windows\\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe"	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD1C7A62-7957-400e-85AF-E72237BEB66F}\stubpath = "C:\\Windows\\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe"	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}\stubpath = "C:\\Windows\\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe"	{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{74AFE3DB-BEAE-4207-A19E-4A6715422655}\stubpath = "C:\\Windows\\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe"	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD1C7A62-7957-400e-85AF-E72237BEB66F}	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37078090-3677-4ac6-B901-A119067EA396}\stubpath = "C:\\Windows\\{37078090-3677-4ac6-B901-A119067EA396}.exe"	{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}\stubpath = "C:\\Windows\\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe"	{37078090-3677-4ac6-B901-A119067EA396}.exe

Executes dropped EXE 11 IoCs

pid	Process
2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
1124	{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
900	{37078090-3677-4ac6-B901-A119067EA396}.exe
1232	{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
2132	{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
File created	C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
File created	C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe	{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
File created	C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe	{37078090-3677-4ac6-B901-A119067EA396}.exe
File created	C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
File created	C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
File created	C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
File created	C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
File created	C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe	{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
File created	C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
File created	C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
Token: SeIncBasePriorityPrivilege	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
Token: SeIncBasePriorityPrivilege	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
Token: SeIncBasePriorityPrivilege	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
Token: SeIncBasePriorityPrivilege	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
Token: SeIncBasePriorityPrivilege	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
Token: SeIncBasePriorityPrivilege	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
Token: SeIncBasePriorityPrivilege	1124	{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
Token: SeIncBasePriorityPrivilege	900	{37078090-3677-4ac6-B901-A119067EA396}.exe
Token: SeIncBasePriorityPrivilege	1232	{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2516	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	28
PID 2992 wrote to memory of 2516	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	28
PID 2992 wrote to memory of 2516	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	28
PID 2992 wrote to memory of 2516	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	28
PID 2992 wrote to memory of 2624	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	29
PID 2992 wrote to memory of 2624	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	29
PID 2992 wrote to memory of 2624	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	29
PID 2992 wrote to memory of 2624	2992	2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe	29
PID 2516 wrote to memory of 3036	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	31
PID 2516 wrote to memory of 3036	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	31
PID 2516 wrote to memory of 3036	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	31
PID 2516 wrote to memory of 3036	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	31
PID 2516 wrote to memory of 2444	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	30
PID 2516 wrote to memory of 2444	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	30
PID 2516 wrote to memory of 2444	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	30
PID 2516 wrote to memory of 2444	2516	{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe	30
PID 3036 wrote to memory of 2460	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	34
PID 3036 wrote to memory of 2460	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	34
PID 3036 wrote to memory of 2460	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	34
PID 3036 wrote to memory of 2460	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	34
PID 3036 wrote to memory of 2964	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	35
PID 3036 wrote to memory of 2964	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	35
PID 3036 wrote to memory of 2964	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	35
PID 3036 wrote to memory of 2964	3036	{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe	35
PID 2460 wrote to memory of 672	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	37
PID 2460 wrote to memory of 672	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	37
PID 2460 wrote to memory of 672	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	37
PID 2460 wrote to memory of 672	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	37
PID 2460 wrote to memory of 436	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	36
PID 2460 wrote to memory of 436	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	36
PID 2460 wrote to memory of 436	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	36
PID 2460 wrote to memory of 436	2460	{F3CF346A-2539-40f5-8782-C944F40E3354}.exe	36
PID 672 wrote to memory of 2512	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	39
PID 672 wrote to memory of 2512	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	39
PID 672 wrote to memory of 2512	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	39
PID 672 wrote to memory of 2512	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	39
PID 672 wrote to memory of 2856	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	38
PID 672 wrote to memory of 2856	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	38
PID 672 wrote to memory of 2856	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	38
PID 672 wrote to memory of 2856	672	{14A14FC4-0568-42c9-9664-05134641DAC0}.exe	38
PID 2512 wrote to memory of 2304	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	41
PID 2512 wrote to memory of 2304	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	41
PID 2512 wrote to memory of 2304	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	41
PID 2512 wrote to memory of 2304	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	41
PID 2512 wrote to memory of 1132	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	40
PID 2512 wrote to memory of 1132	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	40
PID 2512 wrote to memory of 1132	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	40
PID 2512 wrote to memory of 1132	2512	{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe	40
PID 2304 wrote to memory of 1948	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	43
PID 2304 wrote to memory of 1948	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	43
PID 2304 wrote to memory of 1948	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	43
PID 2304 wrote to memory of 1948	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	43
PID 2304 wrote to memory of 2472	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	42
PID 2304 wrote to memory of 2472	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	42
PID 2304 wrote to memory of 2472	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	42
PID 2304 wrote to memory of 2472	2304	{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe	42
PID 1948 wrote to memory of 1124	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	44
PID 1948 wrote to memory of 1124	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	44
PID 1948 wrote to memory of 1124	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	44
PID 1948 wrote to memory of 1124	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	44
PID 1948 wrote to memory of 2288	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	45
PID 1948 wrote to memory of 2288	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	45
PID 1948 wrote to memory of 2288	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	45
PID 1948 wrote to memory of 2288	1948	{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_9d2c783cb14279201d52177459fe9b69_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
  C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{74AFE~1.EXE > nul
    3⤵
    PID:2444
- - C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
    C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
      C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3CF3~1.EXE > nul
        5⤵
        
        PID:436
    - - C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
        
        C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14A14~1.EXE > nul
        6⤵
        
        PID:2856
      - C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
        
        C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B6EED~1.EXE > nul
        7⤵
        
        PID:1132
        
        C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
        
        C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB648~1.EXE > nul
        8⤵
        
        PID:2472
        
        C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
        
        C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
        
        C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7501F~1.EXE > nul
        10⤵
        
        PID:848
        
        C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe
        
        C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37078~1.EXE > nul
        11⤵
        
        PID:2080
        
        C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
        
        C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADA0A~1.EXE > nul
        12⤵
        
        PID:820
        
        C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe
        
        C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe
        12⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD1C7~1.EXE > nul
        9⤵
        
        PID:2288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8A9F3~1.EXE > nul
      4⤵
      PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{14A14FC4-0568-42c9-9664-05134641DAC0}.exe

Filesize
344KB

MD5
74189b3d1a51ca47d21fb89c86542ef9

SHA1
0c882c9e509af0d6371d2954d9f53da73a01bf25

SHA256
a9bdb60ac9fc524d63c8a0624619b5420c781adc1243cc65c32cb2c3ea9edfda

SHA512
6364358b0acb7632c3081a528d34a28a9538c70e1338eb1b28a63f7c54fa749f0c9adcaa4f250da8841cd599e7026bb5120be8190a5397660da92a1a0afb2b85

Download Submit
C:\Windows\{37078090-3677-4ac6-B901-A119067EA396}.exe

Filesize
344KB

MD5
ad9d50835312313d9922aab67b2c626d

SHA1
d5c0f9d23d6722a001429b56194822c7c6ac85e2

SHA256
b41a3991f95fb9c11d56b8cd74b5a3fa1d0005e0e9ddf0d288338d8af6564170

SHA512
5427e89c5ac5b68e6871a6a998c8e47c8a44fc032220cd2af1da3b2c76b77765c3cdf1cd6f9e5c205d65d067df7a5ca414508ec5d3fa7ec63eea59f9f60b7612

Download Submit
C:\Windows\{74AFE3DB-BEAE-4207-A19E-4A6715422655}.exe

Filesize
344KB

MD5
09a2ee257b77db907909f6fe664acf99

SHA1
acbb8b00136e18d5daaacbd0e8a24d01de10b729

SHA256
7a040bf8c970708715407ab576965ebd37dcd9418fd3d82203ddec687faeb00e

SHA512
99f9feb75568784f721d8e341696768acd4234e2e9e62835098236dd2e6fee367df35d8f45cc7d2d3deb9a998f92db002be794163cbd0d5dd136062798def5ba

Download Submit
C:\Windows\{7501F292-EFAC-4bb7-BD11-4A590CD289C2}.exe

Filesize
344KB

MD5
aba0917e5947d6b9a39145fbbb9465ff

SHA1
97b8a237cf2a1861ebb7711f6f59b6ac6a961ad6

SHA256
e361f0e8700833c1159efb7381ff8d9e6d90afe1e2b2d91ec4202d5e9ba2e134

SHA512
8e26e72b763d5b3bde982bf58f8345b2e9e2cea38602c71bdac0371ee837331c4a48664d630c4f94b79447bb38078bc4465ae37316648fab7d25abd6f8d36a3d

Download Submit
C:\Windows\{8A9F3D4C-F9C8-4bfc-859C-3556D3A806EA}.exe

Filesize
344KB

MD5
25942a20e279a185b5b9ca5218bf338a

SHA1
fa06253543431400d231cb3212cd1afe0b6798ff

SHA256
e7e5e8fa089069d376151172cc0746d483cca32046e498c609d5a622a34680a9

SHA512
c626dd26c0817d0c74084eed7d80cb3e2d47e74dd740c200e283ce71f8ec2763291b08fd652718d4c7f5f1b564d4bd3b8016ec2e533b70f5e8521fb13d3e0646

Download Submit
C:\Windows\{ADA0ADA3-61AC-4074-84A5-4EBDC4AD83B9}.exe

Filesize
344KB

MD5
25227b3a5e42a2d675d1d4b9a41f6723

SHA1
3602b9f1aee845378f0c148f6e6a720a3ae2057a

SHA256
f8371584ddfcb7b1819fa39ce5dd96027366dc1a8fa0d6e801ecc21fd7b97688

SHA512
7e5d7bb088ca0e72f85aa0b819494ac3f9ef8c3f099e00a3daf57c1c2b3b4229d7654ffa8c1f47f4961ff71e453a6f9daad4cc7697ccaf10d29c1490fdb08d5e

Download Submit
C:\Windows\{B6EED883-0E00-4eb6-95FA-96DA3B70956E}.exe

Filesize
344KB

MD5
6b6f6bf137fb43fc03d9aae8188a3755

SHA1
908eb3bf49edec20247f335c7b87326a7e2385fe

SHA256
61237280bd59daaeac3384456123a155c4c9b3164d7bb9c64387ed0f97ec102f

SHA512
3967604cf3df0d50e369a154cbdfd453450d67520d80103ac3fb7888f7910c3b502132c70b70f66c166857c0f35b4d55a365c40a267e1b3ecbcc1be2e428e5bb

Download Submit
C:\Windows\{BB648876-F3C8-4711-87CC-0E288C1EE1F3}.exe

Filesize
344KB

MD5
0f6de5f7e2e6055e8e020416b3e61fa9

SHA1
e1ead32db1f57c304c89726b24be4ea9ad2ed73a

SHA256
2e37ac7c5684e73361f01abc8845b072210925f1cc918cf195769aec6df4890c

SHA512
ed7ecc6b163c2ca8cc9b0007f0574bd6adbbb7ceadc59085d075ed43e3531bd0582ef59114cbe8151324a82c74b94b32322ae922b42c39a2f2004ccceb5b9f32

Download Submit
C:\Windows\{F3CF346A-2539-40f5-8782-C944F40E3354}.exe

Filesize
344KB

MD5
d1205637706594620f0f06d7d8cfc295

SHA1
8233be266bcaa2442da13920dc3464b486c9fc15

SHA256
77eeaa482e403475ac61710a98cf333fbf607b061644fd07636b51dd8d0098e2

SHA512
bc928f824f8bc64662dbe12d9284897b5daebd68739bbb3c680d5551318c723d8960935cbfc17d9bc778cca8405e6a8839063d15f746b25b1bc487ee6c1bc75f

Download Submit
C:\Windows\{FCE6B716-5AF3-41f7-B542-F6E649577A9F}.exe

Filesize
344KB

MD5
dbbf1ab7c71544cb4140e9458f102c3b

SHA1
29d44fbb58165dcab61cb85340f610435b1a4926

SHA256
35de9b12a29db0c38d5c119f38365a6a0a8496c6a290bdff40eafd1d84b0d5ae

SHA512
f547d5983b755895f038e2521a12899ff9aaa2cecce96629db8df3287beb58054e414e6ce2660860349a1b801e55fe315f2cb59bbdf42bf24f21c6a0e2e41220

Download Submit
C:\Windows\{FD1C7A62-7957-400e-85AF-E72237BEB66F}.exe

Filesize
344KB

MD5
2d3e9c5ba017c3c57c01d9afdfabe6b6

SHA1
c9b75dfd91ba782861f7cfa53cbaf99c2d12e6f6

SHA256
b9f773120685b204ea87e52a778ec7d0afb36cc7cbdef55e840563b06932b2c5

SHA512
592b865763ac62902c4614035ad2dde5ef41b6c925d3641ac7312064c8db5618f5fd174607066f942083c5b8ea6ad694d59f3ea548906437b7f69ab17302a1ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads