c052255549416e9ec290b58fe344eb185c7d019cd95162151bd18a046cc33097

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 05:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
Size

180KB
MD5

a69ef239f48dfa32d126bcc7e34d66d3
SHA1

95d02543cdbb4688a340f7446b6470c3f2594d8c
SHA256

c052255549416e9ec290b58fe344eb185c7d019cd95162151bd18a046cc33097
SHA512

cf452d21b24e960ac1a9a7abd11beb80edcfd6c664c2d8d664e7367ea2f98b7ea2835d5981feb83685e831b2c398725eeb50f2ae9fb3ea73fc47447cb3f9516d
SSDEEP

3072:jEGh0oSlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGYl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012328-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013413-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012328-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000013a3a-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012328-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012328-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012328-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B755379-7704-4b64-A805-6840D3D8B310}\stubpath = "C:\\Windows\\{5B755379-7704-4b64-A805-6840D3D8B310}.exe"	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}	{5B755379-7704-4b64-A805-6840D3D8B310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5EC528BD-46AD-4298-A646-12B5C2064CD6}	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{833CF578-3E63-4f9a-B17A-341BE3069DD7}	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}\stubpath = "C:\\Windows\\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe"	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5EC528BD-46AD-4298-A646-12B5C2064CD6}\stubpath = "C:\\Windows\\{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe"	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05820FEF-9F5D-46da-9B30-BA32E931431A}\stubpath = "C:\\Windows\\{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe"	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89DA5269-2BF6-4786-BD91-71CB76793F67}	{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}	{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B755379-7704-4b64-A805-6840D3D8B310}	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}\stubpath = "C:\\Windows\\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe"	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{833CF578-3E63-4f9a-B17A-341BE3069DD7}\stubpath = "C:\\Windows\\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe"	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}\stubpath = "C:\\Windows\\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe"	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}	{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}\stubpath = "C:\\Windows\\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe"	{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}\stubpath = "C:\\Windows\\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe"	{5B755379-7704-4b64-A805-6840D3D8B310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05820FEF-9F5D-46da-9B30-BA32E931431A}	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89DA5269-2BF6-4786-BD91-71CB76793F67}\stubpath = "C:\\Windows\\{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe"	{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}\stubpath = "C:\\Windows\\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe"	{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe

Executes dropped EXE 11 IoCs

pid	Process
2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe
2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
1692	{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
2076	{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
1960	{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
1308	{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	{5B755379-7704-4b64-A805-6840D3D8B310}.exe
File created	C:\Windows\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
File created	C:\Windows\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
File created	C:\Windows\{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe	{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
File created	C:\Windows\{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
File created	C:\Windows\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe	{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
File created	C:\Windows\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe	{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
File created	C:\Windows\{5B755379-7704-4b64-A805-6840D3D8B310}.exe	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
File created	C:\Windows\{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
File created	C:\Windows\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
File created	C:\Windows\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe
Token: SeIncBasePriorityPrivilege	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
Token: SeIncBasePriorityPrivilege	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
Token: SeIncBasePriorityPrivilege	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
Token: SeIncBasePriorityPrivilege	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
Token: SeIncBasePriorityPrivilege	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
Token: SeIncBasePriorityPrivilege	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
Token: SeIncBasePriorityPrivilege	1692	{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
Token: SeIncBasePriorityPrivilege	2076	{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
Token: SeIncBasePriorityPrivilege	1960	{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2740	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	28
PID 2880 wrote to memory of 2740	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	28
PID 2880 wrote to memory of 2740	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	28
PID 2880 wrote to memory of 2740	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	28
PID 2880 wrote to memory of 2964	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	29
PID 2880 wrote to memory of 2964	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	29
PID 2880 wrote to memory of 2964	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	29
PID 2880 wrote to memory of 2964	2880	2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe	29
PID 2740 wrote to memory of 2816	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	30
PID 2740 wrote to memory of 2816	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	30
PID 2740 wrote to memory of 2816	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	30
PID 2740 wrote to memory of 2816	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	30
PID 2740 wrote to memory of 2720	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	31
PID 2740 wrote to memory of 2720	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	31
PID 2740 wrote to memory of 2720	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	31
PID 2740 wrote to memory of 2720	2740	{5B755379-7704-4b64-A805-6840D3D8B310}.exe	31
PID 2816 wrote to memory of 2728	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	32
PID 2816 wrote to memory of 2728	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	32
PID 2816 wrote to memory of 2728	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	32
PID 2816 wrote to memory of 2728	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	32
PID 2816 wrote to memory of 2512	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	33
PID 2816 wrote to memory of 2512	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	33
PID 2816 wrote to memory of 2512	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	33
PID 2816 wrote to memory of 2512	2816	{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe	33
PID 2728 wrote to memory of 296	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	37
PID 2728 wrote to memory of 296	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	37
PID 2728 wrote to memory of 296	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	37
PID 2728 wrote to memory of 296	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	37
PID 2728 wrote to memory of 1456	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	36
PID 2728 wrote to memory of 1456	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	36
PID 2728 wrote to memory of 1456	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	36
PID 2728 wrote to memory of 1456	2728	{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe	36
PID 296 wrote to memory of 2644	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	38
PID 296 wrote to memory of 2644	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	38
PID 296 wrote to memory of 2644	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	38
PID 296 wrote to memory of 2644	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	38
PID 296 wrote to memory of 2908	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	39
PID 296 wrote to memory of 2908	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	39
PID 296 wrote to memory of 2908	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	39
PID 296 wrote to memory of 2908	296	{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe	39
PID 2644 wrote to memory of 1996	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	40
PID 2644 wrote to memory of 1996	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	40
PID 2644 wrote to memory of 1996	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	40
PID 2644 wrote to memory of 1996	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	40
PID 2644 wrote to memory of 2028	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	41
PID 2644 wrote to memory of 2028	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	41
PID 2644 wrote to memory of 2028	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	41
PID 2644 wrote to memory of 2028	2644	{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe	41
PID 1996 wrote to memory of 1908	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	43
PID 1996 wrote to memory of 1908	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	43
PID 1996 wrote to memory of 1908	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	43
PID 1996 wrote to memory of 1908	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	43
PID 1996 wrote to memory of 2344	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	42
PID 1996 wrote to memory of 2344	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	42
PID 1996 wrote to memory of 2344	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	42
PID 1996 wrote to memory of 2344	1996	{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe	42
PID 1908 wrote to memory of 1692	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	44
PID 1908 wrote to memory of 1692	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	44
PID 1908 wrote to memory of 1692	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	44
PID 1908 wrote to memory of 1692	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	44
PID 1908 wrote to memory of 1148	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	45
PID 1908 wrote to memory of 1148	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	45
PID 1908 wrote to memory of 1148	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	45
PID 1908 wrote to memory of 1148	1908	{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_a69ef239f48dfa32d126bcc7e34d66d3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\{5B755379-7704-4b64-A805-6840D3D8B310}.exe
  C:\Windows\{5B755379-7704-4b64-A805-6840D3D8B310}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
    C:\Windows\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
      C:\Windows\{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5EC52~1.EXE > nul
        5⤵
        
        PID:1456
    - - C:\Windows\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
        
        C:\Windows\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:296
      - C:\Windows\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
        
        C:\Windows\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
        
        C:\Windows\{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{05820~1.EXE > nul
        8⤵
        
        PID:2344
        
        C:\Windows\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
        
        C:\Windows\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
        
        C:\Windows\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
        
        C:\Windows\{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
        
        C:\Windows\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
        
        C:\Windows\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe
        
        C:\Windows\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe
        12⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A31F0~1.EXE > nul
        12⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89DA5~1.EXE > nul
        11⤵
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A90F2~1.EXE > nul
        10⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C1CAF~1.EXE > nul
        9⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{833CF~1.EXE > nul
        7⤵
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E09C0~1.EXE > nul
        6⤵
        
        PID:2908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D90CF~1.EXE > nul
      4⤵
      PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5B755~1.EXE > nul
    3⤵
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{05820FEF-9F5D-46da-9B30-BA32E931431A}.exe

Filesize
180KB

MD5
230a37dcab9a0ca74b8d0c5ec474654a

SHA1
e465fc1648e2e830e2519fc3bb144415c7c82e8c

SHA256
2287c5aed18d944adeedfb4289e269ce552469752de9747748a95baed52a9092

SHA512
ddfaee910b4809878980348a75a6ce0aa942bb370dc326c4adee8e7285333016c1ee8ee39775c913d4f93a442426ea6e6c6488817bb14b150b19f732ccdb2859

Download Submit
C:\Windows\{5B755379-7704-4b64-A805-6840D3D8B310}.exe

Filesize
180KB

MD5
2ef360c68da806a403f990a6461f70c5

SHA1
78623391f6064edc6f0573e0f734888c720c3ebe

SHA256
cd186a06324374c00931d2d4d82a500f31268cdd71493e044d1c01ca12d7c5d9

SHA512
a1148dec6b45b8e4d7f55d1653b7b7ef95596b0eb6cbe952ccf5ebf0983dc3bb15f5f9bd7002f27feda186074e93fd470069e90c7bf8645914737c338ba9ac35

Download Submit
C:\Windows\{5EC528BD-46AD-4298-A646-12B5C2064CD6}.exe

Filesize
180KB

MD5
95cd50fad28d5da18a8c67b5cdc89b81

SHA1
b9b31aa07a9e73a6075fddd6027b52d50abe45b2

SHA256
00c604b7daead4f4f296d7399d03685645249e94c84d0c3b7533f03282001c62

SHA512
d8ff6324dc5c905c6762084c5128819716e30eef313e7e1dd7df3c24b5a388563e9204529006b37759bb0ef2505db4e4857446f866c209a818f7f0bf4b41856c

Download Submit
C:\Windows\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe

Filesize
180KB

MD5
e312054dab17d8e65fc7bb67a9bb5a6c

SHA1
fb7ff4701b9b0cab1ae1202ca0b382677ea44550

SHA256
b99b53261b8d0d9076ddf1b94cbe09b0c04f75a81cf2747154a1b35dab2efac9

SHA512
66cb0dd4d871a18cc3ce66898191174db85d2c25719f79418254964b952df0dfcd192f0700b13ab5cb2719c3d5fabbc89f8669e42e4459f850710cfa8cc81657

Download Submit
C:\Windows\{833CF578-3E63-4f9a-B17A-341BE3069DD7}.exe

Filesize
5KB

MD5
34bc67e64361094aebdf0880ec3a03b9

SHA1
bdd62bd41284d2f325dc7151c4feb3e572e8113f

SHA256
6fdbe4983ec12a214d59949a9281e8956092ce8f026f6852f412f112fbf126e5

SHA512
c72a4da39cf90d30074f185a362d478022bb48d5dd7b358153ce9740a9765d5a54ffb9067caba283de0971900a3bf1e36b3aae224fbf2d172104aaefd33796a0

Download Submit
C:\Windows\{89DA5269-2BF6-4786-BD91-71CB76793F67}.exe

Filesize
180KB

MD5
e0707170d0e864c7153f3657067c8cd5

SHA1
b08774381bbf723d37fa6c84d10e1086143dd030

SHA256
999a7e5d979705dc1310f64d893996b75f31782eb0332851c4c8b84e2570de6b

SHA512
9a3f99a89991f04eb90639ad3d992c62f946276f45d9a7307cdfeeb0d3746a442c8c17cd92210b69246f2e81cf2c0326dc8493009329616ea637071cd8af868d

Download Submit
C:\Windows\{A31F0911-2F2E-4e75-A58E-DB3630D83E0F}.exe

Filesize
180KB

MD5
02dbd2bfdea659049d68dd7f4b50c605

SHA1
90f34eb6d71917b4b925b056f7fdfd79d14ea245

SHA256
7744bf92ae852a02f5d50aa19e238ffde78c8c17ca2274afa61cfed7a1f8892b

SHA512
822d4021544f91104a917e823eadd92786760b23432519fbdc020e5655a0f5025f5ca23a84218757f02c5cb18298246102fd35cf185b66991f9c850eb1bd3edf

Download Submit
C:\Windows\{A90F2407-698B-4e9b-A11F-DBD7DAF3EC6C}.exe

Filesize
180KB

MD5
a8e13b0e8b7365c371eb613f7f1ac556

SHA1
e368ed9416d5edc569f5aef93260dc861bc18339

SHA256
78b4637f71d3d9c22b5cb9c723592992a8e1906f2821b8934a0454fc46d6f265

SHA512
eb944c6c916006f4d8f16641a28ba0974338cc5d00606dc3e1ebfcc03774a1d456901126ce2ce86dc4f1befc08a7dd4d3486305757ac651c1094e11b0e9dc895

Download Submit
C:\Windows\{C1CAF0DA-3A93-4541-BF67-D7652B34DC0C}.exe

Filesize
180KB

MD5
ff97f2afe9ed76b6142c41638c52b8f3

SHA1
f7bebf6c79b938b38ab4c51568ec7f50fe56e9cf

SHA256
57699025b157a2793beb5253261370ae0be9a9a069c293276cb0e66aee969617

SHA512
e66038a946f55b666699ea686229e5b295ffda4c94017c3ee12138cbd9cd38d806e40f8b05cdc43db99f63ddf6953caa36c5dfe45c43ea9e77a9e89495f08b0d

Download Submit
C:\Windows\{C3A2FA5F-1AA5-4601-895B-6B56AA2C08EB}.exe

Filesize
180KB

MD5
cb402298e156506f375128899cf1e435

SHA1
3ed53b68bc72c2792946d298d7fdb8a6c3e1d82d

SHA256
693ee10b016588b553665f2ea4c9979a99563b0ec2343b8820b932bcc80b1690

SHA512
613cc944c370a3a501c7f4af05f08b388c05c738d5c9f05f5f3048a14d886d77daee25a2eba322f0a915389ac0f06e62c1a20218237484af68ba9a3a324a6c51

Download Submit
C:\Windows\{D90CF428-9B2A-4a8d-9709-8E8B0732ECD5}.exe

Filesize
180KB

MD5
780809cd8cedba71ce97ad5abfea7e34

SHA1
23bcb1fead83aa6b9ceca46efb918da0231a945a

SHA256
21c9d5a6d788d760cc97feb4e5d86f80a417f97146a2fd6a250e7c840c906e1f

SHA512
37f1a3bf4479fb4ca126b0bda135b6ddf4843bbc9addbf3e8b25f82013c3abc458118c6028db944a3c7976eb95f13865a21aa8e0cd316f7215b05567452c90f3

Download Submit
C:\Windows\{E09C01A7-C8FC-40ce-BD58-EF35EB38F1CF}.exe

Filesize
180KB

MD5
bc36501514133ea39666ce68cdbe2763

SHA1
16be1ed9c69ea1fa047663c214b55518dde13734

SHA256
e08cf6617c2eddfcaf13abd41f99ef901f8a140c069de24480414ca3c5c103ad

SHA512
f4a8cf9c3633334297922fbce7adb7c1a3bf5ca73584782869446b42b0b9c2b22374053dd6206203b28cdb426a6fafc461e9aa99dc6d03eece648c79e6b2921f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads