7af5c1fd09784a4a3171dd036f2988297ef40935a134f54195d412a9076c54ff

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
Size

180KB
MD5

ca104afe01c7308991a7640d2a1892f9
SHA1

5fb7ca6dfed7f7df909845345ffd434fea350a6e
SHA256

7af5c1fd09784a4a3171dd036f2988297ef40935a134f54195d412a9076c54ff
SHA512

61db4f79c14e9990671c9d1540f577bb056cad3676aa552ae593a5b9e0353c7acc591ccc3614ea62831044bb38fb34e30ff2a2792265c6c0db5ef449a3a825b2
SSDEEP

3072:jEGh0o4lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGul5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015653-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000012251-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0034000000015cae-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012251-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012251-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012251-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}	{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}\stubpath = "C:\\Windows\\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe"	{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60AE8367-9F75-436d-8311-7FA194E59275}\stubpath = "C:\\Windows\\{60AE8367-9F75-436d-8311-7FA194E59275}.exe"	{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70647D05-347F-4984-B141-503308D2AF8C}\stubpath = "C:\\Windows\\{70647D05-347F-4984-B141-503308D2AF8C}.exe"	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}\stubpath = "C:\\Windows\\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe"	{168E7C98-654F-4659-9F50-4BF401743513}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}\stubpath = "C:\\Windows\\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe"	{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{056C096C-A673-4292-8715-86838579EF35}	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}\stubpath = "C:\\Windows\\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe"	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE2D36B7-833A-4000-8145-FA361CB89799}\stubpath = "C:\\Windows\\{DE2D36B7-833A-4000-8145-FA361CB89799}.exe"	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}	{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60AE8367-9F75-436d-8311-7FA194E59275}	{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{168E7C98-654F-4659-9F50-4BF401743513}	{70647D05-347F-4984-B141-503308D2AF8C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48BE3FAD-9505-4a93-AAF8-9C699F069529}\stubpath = "C:\\Windows\\{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe"	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE2D36B7-833A-4000-8145-FA361CB89799}	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70647D05-347F-4984-B141-503308D2AF8C}	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{168E7C98-654F-4659-9F50-4BF401743513}\stubpath = "C:\\Windows\\{168E7C98-654F-4659-9F50-4BF401743513}.exe"	{70647D05-347F-4984-B141-503308D2AF8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}	{168E7C98-654F-4659-9F50-4BF401743513}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48BE3FAD-9505-4a93-AAF8-9C699F069529}	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{056C096C-A673-4292-8715-86838579EF35}\stubpath = "C:\\Windows\\{056C096C-A673-4292-8715-86838579EF35}.exe"	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}	{056C096C-A673-4292-8715-86838579EF35}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}\stubpath = "C:\\Windows\\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe"	{056C096C-A673-4292-8715-86838579EF35}.exe

Deletes itself 1 IoCs

pid	Process
2944	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1760	{056C096C-A673-4292-8715-86838579EF35}.exe
2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe
2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe
2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
1192	{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
2292	{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
2824	{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
1056	{60AE8367-9F75-436d-8311-7FA194E59275}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe	{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
File created	C:\Windows\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe	{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
File created	C:\Windows\{60AE8367-9F75-436d-8311-7FA194E59275}.exe	{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
File created	C:\Windows\{056C096C-A673-4292-8715-86838579EF35}.exe	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
File created	C:\Windows\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
File created	C:\Windows\{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
File created	C:\Windows\{DE2D36B7-833A-4000-8145-FA361CB89799}.exe	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
File created	C:\Windows\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	{056C096C-A673-4292-8715-86838579EF35}.exe
File created	C:\Windows\{70647D05-347F-4984-B141-503308D2AF8C}.exe	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
File created	C:\Windows\{168E7C98-654F-4659-9F50-4BF401743513}.exe	{70647D05-347F-4984-B141-503308D2AF8C}.exe
File created	C:\Windows\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	{168E7C98-654F-4659-9F50-4BF401743513}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1760	{056C096C-A673-4292-8715-86838579EF35}.exe
Token: SeIncBasePriorityPrivilege	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
Token: SeIncBasePriorityPrivilege	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe
Token: SeIncBasePriorityPrivilege	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe
Token: SeIncBasePriorityPrivilege	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
Token: SeIncBasePriorityPrivilege	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
Token: SeIncBasePriorityPrivilege	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
Token: SeIncBasePriorityPrivilege	1192	{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
Token: SeIncBasePriorityPrivilege	2292	{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
Token: SeIncBasePriorityPrivilege	2824	{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1760	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	28
PID 2876 wrote to memory of 1760	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	28
PID 2876 wrote to memory of 1760	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	28
PID 2876 wrote to memory of 1760	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	28
PID 2876 wrote to memory of 2944	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	29
PID 2876 wrote to memory of 2944	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	29
PID 2876 wrote to memory of 2944	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	29
PID 2876 wrote to memory of 2944	2876	2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe	29
PID 1760 wrote to memory of 2816	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	30
PID 1760 wrote to memory of 2816	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	30
PID 1760 wrote to memory of 2816	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	30
PID 1760 wrote to memory of 2816	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	30
PID 1760 wrote to memory of 1988	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	31
PID 1760 wrote to memory of 1988	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	31
PID 1760 wrote to memory of 1988	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	31
PID 1760 wrote to memory of 1988	1760	{056C096C-A673-4292-8715-86838579EF35}.exe	31
PID 2816 wrote to memory of 2480	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	32
PID 2816 wrote to memory of 2480	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	32
PID 2816 wrote to memory of 2480	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	32
PID 2816 wrote to memory of 2480	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	32
PID 2816 wrote to memory of 2468	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	33
PID 2816 wrote to memory of 2468	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	33
PID 2816 wrote to memory of 2468	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	33
PID 2816 wrote to memory of 2468	2816	{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe	33
PID 2480 wrote to memory of 2032	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	37
PID 2480 wrote to memory of 2032	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	37
PID 2480 wrote to memory of 2032	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	37
PID 2480 wrote to memory of 2032	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	37
PID 2480 wrote to memory of 2172	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	36
PID 2480 wrote to memory of 2172	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	36
PID 2480 wrote to memory of 2172	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	36
PID 2480 wrote to memory of 2172	2480	{70647D05-347F-4984-B141-503308D2AF8C}.exe	36
PID 2032 wrote to memory of 2724	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	38
PID 2032 wrote to memory of 2724	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	38
PID 2032 wrote to memory of 2724	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	38
PID 2032 wrote to memory of 2724	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	38
PID 2032 wrote to memory of 2548	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	39
PID 2032 wrote to memory of 2548	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	39
PID 2032 wrote to memory of 2548	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	39
PID 2032 wrote to memory of 2548	2032	{168E7C98-654F-4659-9F50-4BF401743513}.exe	39
PID 2724 wrote to memory of 2028	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	40
PID 2724 wrote to memory of 2028	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	40
PID 2724 wrote to memory of 2028	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	40
PID 2724 wrote to memory of 2028	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	40
PID 2724 wrote to memory of 1628	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	41
PID 2724 wrote to memory of 1628	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	41
PID 2724 wrote to memory of 1628	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	41
PID 2724 wrote to memory of 1628	2724	{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe	41
PID 2028 wrote to memory of 1948	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	43
PID 2028 wrote to memory of 1948	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	43
PID 2028 wrote to memory of 1948	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	43
PID 2028 wrote to memory of 1948	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	43
PID 2028 wrote to memory of 1844	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	42
PID 2028 wrote to memory of 1844	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	42
PID 2028 wrote to memory of 1844	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	42
PID 2028 wrote to memory of 1844	2028	{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe	42
PID 1948 wrote to memory of 1192	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	44
PID 1948 wrote to memory of 1192	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	44
PID 1948 wrote to memory of 1192	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	44
PID 1948 wrote to memory of 1192	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	44
PID 1948 wrote to memory of 868	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	45
PID 1948 wrote to memory of 868	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	45
PID 1948 wrote to memory of 868	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	45
PID 1948 wrote to memory of 868	1948	{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_ca104afe01c7308991a7640d2a1892f9_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\{056C096C-A673-4292-8715-86838579EF35}.exe
  C:\Windows\{056C096C-A673-4292-8715-86838579EF35}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
    C:\Windows\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\{70647D05-347F-4984-B141-503308D2AF8C}.exe
      C:\Windows\{70647D05-347F-4984-B141-503308D2AF8C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70647~1.EXE > nul
        5⤵
        
        PID:2172
    - - C:\Windows\{168E7C98-654F-4659-9F50-4BF401743513}.exe
        
        C:\Windows\{168E7C98-654F-4659-9F50-4BF401743513}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Windows\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
        
        C:\Windows\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
        
        C:\Windows\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0FF68~1.EXE > nul
        8⤵
        
        PID:1844
        
        C:\Windows\{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
        
        C:\Windows\{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
        
        C:\Windows\{DE2D36B7-833A-4000-8145-FA361CB89799}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
        
        C:\Windows\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
        
        C:\Windows\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\{60AE8367-9F75-436d-8311-7FA194E59275}.exe
        
        C:\Windows\{60AE8367-9F75-436d-8311-7FA194E59275}.exe
        12⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D1DB8~1.EXE > nul
        12⤵
        
        PID:596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D63A~1.EXE > nul
        11⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE2D3~1.EXE > nul
        10⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48BE3~1.EXE > nul
        9⤵
        
        PID:868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A9CF~1.EXE > nul
        7⤵
        
        PID:1628
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{168E7~1.EXE > nul
        6⤵
        
        PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CBF57~1.EXE > nul
      4⤵
      PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{056C0~1.EXE > nul
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{056C096C-A673-4292-8715-86838579EF35}.exe

Filesize
180KB

MD5
d3bbe0f99acbb76e2431fc5469f87c14

SHA1
e7ebb0bae949b744c16c204abbdebfa5ca231532

SHA256
53e59dd285bae070e94e7500e5ce949a9741277453249af3956849e210a45f53

SHA512
afeb9130d582338bddd27bd3c1e0a520925106e1e651b8df11bbcf527997c7d634cf7521799c7a480a648c3853970325d3041b2b82ddc1e8cc2e567c582fb514

Download Submit
C:\Windows\{0D63A1C2-8DCD-41cf-8F57-6664F4F86475}.exe

Filesize
180KB

MD5
7e7d39cc92a9c193b638fa27cfe8f00e

SHA1
c443a835f3395badb16ffa670e3a2793bec0f7dc

SHA256
2072ed8b7ed4dab5216a99bebe0518695d882468493208cb87876757439ad5c0

SHA512
2438ae14eab049e58c49960c43fe21768d3c1dad6f0699a6176d7268b5490d8d8d8a8585fa99d95b1729c5cea7f261e6590e543647b8771ec78768ee86adb385

Download Submit
C:\Windows\{0FF6835B-B9A9-44aa-B844-B62599A1AB1B}.exe

Filesize
180KB

MD5
26474233d777210fa52da1778df93a26

SHA1
963617a11800f17f1e181132f5012435d7c433ad

SHA256
0122ec1542675e36a45c34a90a2b76075002659f34ab61be5bbf0a0c19a82281

SHA512
b7478300aadefe1df38789c5a3e448d6ed7c877dd72eec43cf5cf0749938f97e5fa2b4d52c5c6d7a6c9551d07036ee479ec0f62be5d95c08b88d8d59b14aea22

Download Submit
C:\Windows\{168E7C98-654F-4659-9F50-4BF401743513}.exe

Filesize
180KB

MD5
ef2d5b01be7a13b57bcb11606f4196c1

SHA1
a5dbc48d2e74b84e9f4a26ec690ddeff2e4f5ebd

SHA256
ce62e10522aecec4673244f1d9e2708a5ee264c14f7b2fce2b52a7a1d026d1d7

SHA512
ecea663b7ba6e0d0b53144faad9e60e9b161799e72c30352b8d9721ce9d98d6bfebb36f36651a86e3e00df0c7f051546e3d2aeb15197858d4c066154232a8cc1

Download Submit
C:\Windows\{48BE3FAD-9505-4a93-AAF8-9C699F069529}.exe

Filesize
180KB

MD5
b930c0d18789de0cf1f82ff67a410079

SHA1
7bc0e84069362b3b21d2cc063ad698ffb1c9516d

SHA256
7de5637d1dceb3188b318c16015407342111d837509a3838d4ef7fe8c9ff694e

SHA512
eaa6ed69f3d7bcc5abdb997c4b10a0321babd499161fa1b4128e6471aa3dfe9210576f6f78ad7103e62cb97348c5e08fe28fc6310eb95c4c3cceedae4d206fd7

Download Submit
C:\Windows\{60AE8367-9F75-436d-8311-7FA194E59275}.exe

Filesize
180KB

MD5
b460174d8c338d19f07bb5f688d8a1ef

SHA1
bb6897c268a91008a04a0fb63b1f267c974d0151

SHA256
34c13c94eeea91a77015b16f30962c1ab360d8ee32d8163a526fad35ce73b8cd

SHA512
6bbe12dd14eb60bd2ab27dbd98a17cdb6208ff17139a7268aaa7fceb762831ada22083b865e261c6dd3e4812f6a7866b242023017a8b0bc003397489abcfbcc3

Download Submit
C:\Windows\{70647D05-347F-4984-B141-503308D2AF8C}.exe

Filesize
180KB

MD5
f61c2c9bd6dccee27c88260580a5b9bf

SHA1
9db92fd7eee50ed7758b3e511578ec3d8ca21452

SHA256
717f1ef19c4e9cfafcd554c7a4b06da50de0577771b3fc52834209c374729327

SHA512
6aabaa6f5f3b9ee773218e5c3e678ba26e7f600fdcd690a33369c82cb63018c820d26269ca1bc045c7e413178d2f67c620a1d9b50c631dd9fd69f219219097d7

Download Submit
C:\Windows\{7A9CF7E1-2DC8-4292-9417-C7EA6064E0E4}.exe

Filesize
180KB

MD5
f1c1e02df031ce718924f4003e6e1b07

SHA1
6b42d340951796fcbfb12d6e5388e11e8ae790cf

SHA256
dc8f026ff09ee3527563b6dc20bcf959ad852b579267dfc6ca1a221af59d724d

SHA512
7464f131c850e84cc48615e35ce5934b3fe62c02951d5e0336b3ff5e6832d6a8796c55d7ff142c5821e449cd317dbf25155d3cc84d0b6cde5b630f2a24cae315

Download Submit
C:\Windows\{CBF573BB-1E1C-4fa6-AB4F-453E2D402441}.exe

Filesize
180KB

MD5
5767c511646c288e9eaa6a5e23e89f3f

SHA1
c482ce163a1ed19acda93e7b80ea90af471012d6

SHA256
caf92227531184abb681ea917e7459dfc4484f5e80070f911db23b7fb98cfc82

SHA512
568beaf384ced4cf6d7cc01d272f2fd8e4a5bba3ba9a2cf0ec343aba53a9d3cf06e3e01ed3a1eaede154d322c17e7bd97ef1cb03c84895931759557526463171

Download Submit
C:\Windows\{D1DB83DF-98ED-41fa-B686-DBB9E5BCE383}.exe

Filesize
180KB

MD5
ea6fa35725000979faace729c7879dbc

SHA1
c9cd4cddd709ed27518fbc8b506d824b65421672

SHA256
9c0ad5fe01e88c8f27cc5ce821bda8c1014526ec3fb86d0801e90dcd24026422

SHA512
5e49df6c4a195848139d98df53a11088d1cc5b964b22a0884e608309e8da2e006bf56e33eb765ad32dffc6d84df585aa197ffc6ad224e6b4a2f225ab7e931f5e

Download Submit
C:\Windows\{DE2D36B7-833A-4000-8145-FA361CB89799}.exe

Filesize
180KB

MD5
079fb7256e334244a1d9a8454d01915e

SHA1
33ef75cc8cff6efa49f610291bc64a2b9678bead

SHA256
a2ec0f2946a65ebfe621086c049de90f06c6bdaf9aff7831d9f59979accf3c5a

SHA512
9a1765d3c88b2ba257bad34ab8c42703fdae0a6158179e6941b137d6fb05db6663b15ac2ca7a61aa6f4af593a1db49cda5047b73b5c67365993822c1c95d2b98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads