42e08e90c2816f29ee731cd5acf3fb826aef24ae66a890ed20059567e830229d

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe
Size

197KB
MD5

5b7a334f254fb584e0ce8faa81c233bf
SHA1

2beeb5d3bd037985313a4171e59377a642ac6463
SHA256

42e08e90c2816f29ee731cd5acf3fb826aef24ae66a890ed20059567e830229d
SHA512

d10ce77cbf21a8050266d257a5998acda5336bcaa060f1fbeae067ff7b9b5d8a816f62d7cb94934e8f270a310fa65a1d0cca0c96331fc07d0738661b4a6dbc73
SSDEEP

3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGXlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012257-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014230-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012257-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012257-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012257-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012257-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0011000000012257-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{244F1F24-B12D-481b-AC51-626445B1C77C}	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B9239FE-A59D-4d87-A496-83043D04D757}	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{244F1F24-B12D-481b-AC51-626445B1C77C}\stubpath = "C:\\Windows\\{244F1F24-B12D-481b-AC51-626445B1C77C}.exe"	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F51A164E-98AE-4cb3-9892-366CA70246A2}	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30E579C1-AE96-4db6-AD03-66D64111CDC4}	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30E579C1-AE96-4db6-AD03-66D64111CDC4}\stubpath = "C:\\Windows\\{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe"	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}	{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}\stubpath = "C:\\Windows\\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe"	{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}	{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E31524F-7ED1-4898-883B-FF2173F42099}	{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E31524F-7ED1-4898-883B-FF2173F42099}\stubpath = "C:\\Windows\\{3E31524F-7ED1-4898-883B-FF2173F42099}.exe"	{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}\stubpath = "C:\\Windows\\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe"	{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}\stubpath = "C:\\Windows\\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe"	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}\stubpath = "C:\\Windows\\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe"	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B9239FE-A59D-4d87-A496-83043D04D757}\stubpath = "C:\\Windows\\{6B9239FE-A59D-4d87-A496-83043D04D757}.exe"	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F51A164E-98AE-4cb3-9892-366CA70246A2}\stubpath = "C:\\Windows\\{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe"	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}\stubpath = "C:\\Windows\\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe"	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}\stubpath = "C:\\Windows\\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe"	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe

Executes dropped EXE 11 IoCs

pid	Process
2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
556	{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
660	{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
2956	{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
1296	{3E31524F-7ED1-4898-883B-FF2173F42099}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{3E31524F-7ED1-4898-883B-FF2173F42099}.exe	{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
File created	C:\Windows\{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
File created	C:\Windows\{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
File created	C:\Windows\{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
File created	C:\Windows\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
File created	C:\Windows\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe	{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
File created	C:\Windows\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe
File created	C:\Windows\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
File created	C:\Windows\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
File created	C:\Windows\{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
File created	C:\Windows\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe	{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
Token: SeIncBasePriorityPrivilege	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
Token: SeIncBasePriorityPrivilege	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
Token: SeIncBasePriorityPrivilege	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
Token: SeIncBasePriorityPrivilege	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
Token: SeIncBasePriorityPrivilege	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
Token: SeIncBasePriorityPrivilege	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
Token: SeIncBasePriorityPrivilege	556	{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
Token: SeIncBasePriorityPrivilege	660	{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
Token: SeIncBasePriorityPrivilege	2956	{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2972	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	28
PID 2964 wrote to memory of 2972	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	28
PID 2964 wrote to memory of 2972	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	28
PID 2964 wrote to memory of 2972	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	28
PID 2964 wrote to memory of 2504	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	29
PID 2964 wrote to memory of 2504	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	29
PID 2964 wrote to memory of 2504	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	29
PID 2964 wrote to memory of 2504	2964	2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe	29
PID 2972 wrote to memory of 2636	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	31
PID 2972 wrote to memory of 2636	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	31
PID 2972 wrote to memory of 2636	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	31
PID 2972 wrote to memory of 2636	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	31
PID 2972 wrote to memory of 2800	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	30
PID 2972 wrote to memory of 2800	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	30
PID 2972 wrote to memory of 2800	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	30
PID 2972 wrote to memory of 2800	2972	{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe	30
PID 2636 wrote to memory of 2664	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	33
PID 2636 wrote to memory of 2664	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	33
PID 2636 wrote to memory of 2664	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	33
PID 2636 wrote to memory of 2664	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	33
PID 2636 wrote to memory of 2980	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	32
PID 2636 wrote to memory of 2980	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	32
PID 2636 wrote to memory of 2980	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	32
PID 2636 wrote to memory of 2980	2636	{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe	32
PID 2664 wrote to memory of 2920	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	37
PID 2664 wrote to memory of 2920	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	37
PID 2664 wrote to memory of 2920	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	37
PID 2664 wrote to memory of 2920	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	37
PID 2664 wrote to memory of 2036	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	36
PID 2664 wrote to memory of 2036	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	36
PID 2664 wrote to memory of 2036	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	36
PID 2664 wrote to memory of 2036	2664	{244F1F24-B12D-481b-AC51-626445B1C77C}.exe	36
PID 2920 wrote to memory of 2732	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	39
PID 2920 wrote to memory of 2732	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	39
PID 2920 wrote to memory of 2732	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	39
PID 2920 wrote to memory of 2732	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	39
PID 2920 wrote to memory of 2776	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	38
PID 2920 wrote to memory of 2776	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	38
PID 2920 wrote to memory of 2776	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	38
PID 2920 wrote to memory of 2776	2920	{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe	38
PID 2732 wrote to memory of 1360	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	41
PID 2732 wrote to memory of 1360	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	41
PID 2732 wrote to memory of 1360	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	41
PID 2732 wrote to memory of 1360	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	41
PID 2732 wrote to memory of 1628	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	40
PID 2732 wrote to memory of 1628	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	40
PID 2732 wrote to memory of 1628	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	40
PID 2732 wrote to memory of 1628	2732	{6B9239FE-A59D-4d87-A496-83043D04D757}.exe	40
PID 1360 wrote to memory of 1712	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	42
PID 1360 wrote to memory of 1712	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	42
PID 1360 wrote to memory of 1712	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	42
PID 1360 wrote to memory of 1712	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	42
PID 1360 wrote to memory of 320	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	43
PID 1360 wrote to memory of 320	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	43
PID 1360 wrote to memory of 320	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	43
PID 1360 wrote to memory of 320	1360	{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe	43
PID 1712 wrote to memory of 556	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	45
PID 1712 wrote to memory of 556	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	45
PID 1712 wrote to memory of 556	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	45
PID 1712 wrote to memory of 556	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	45
PID 1712 wrote to memory of 2884	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	44
PID 1712 wrote to memory of 2884	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	44
PID 1712 wrote to memory of 2884	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	44
PID 1712 wrote to memory of 2884	1712	{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_5b7a334f254fb584e0ce8faa81c233bf_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
  C:\Windows\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A0556~1.EXE > nul
    3⤵
    PID:2800
- - C:\Windows\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
    C:\Windows\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{70FF4~1.EXE > nul
      4⤵
      PID:2980
  - - C:\Windows\{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
      C:\Windows\{244F1F24-B12D-481b-AC51-626445B1C77C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{244F1~1.EXE > nul
        5⤵
        
        PID:2036
    - - C:\Windows\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
        
        C:\Windows\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3465~1.EXE > nul
        6⤵
        
        PID:2776
      - C:\Windows\{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
        
        C:\Windows\{6B9239FE-A59D-4d87-A496-83043D04D757}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B923~1.EXE > nul
        7⤵
        
        PID:1628
        
        C:\Windows\{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
        
        C:\Windows\{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
        
        C:\Windows\{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30E57~1.EXE > nul
        9⤵
        
        PID:2884
        
        C:\Windows\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
        
        C:\Windows\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2DEBD~1.EXE > nul
        10⤵
        
        PID:1560
        
        C:\Windows\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
        
        C:\Windows\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
        
        C:\Windows\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
        
        C:\Windows\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F7471~1.EXE > nul
        12⤵
        
        PID:828
        
        C:\Windows\{3E31524F-7ED1-4898-883B-FF2173F42099}.exe
        
        C:\Windows\{3E31524F-7ED1-4898-883B-FF2173F42099}.exe
        12⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8EACD~1.EXE > nul
        11⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F51A1~1.EXE > nul
        8⤵
        
        PID:320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{244F1F24-B12D-481b-AC51-626445B1C77C}.exe

Filesize
197KB

MD5
8a84dc4f1ac57db7159d2ca71cc5dff0

SHA1
926db0fd4387b8f725fa120c92871f113100b60e

SHA256
4192ff8b16396d6c573cf86e0dc6c8508fd998380858832e4f0890584048db8d

SHA512
f44512eca78a733a6243ac5adbac6a74f873ac79401d9e305bdd4ae877d1da0b298871004f2f3d5a73a049f975260421f16336d2cb3ef9524f1f20c784fba3e4

Download Submit
C:\Windows\{2DEBD0FB-F08C-4baf-8E52-FA54E5D5B084}.exe

Filesize
197KB

MD5
76b9d84618a2cfbeb1aa0dcfe4bf2a28

SHA1
b69b6db51f4ddedfcd0ec655c4e9efbbf417db92

SHA256
ddb3e3ab431bbd49173fae71280d42b592781d765e93c0988d05f2cfbf300916

SHA512
2a8963bcea1dbb83960076a9409536b00376e4416662837722f1216744219d30d99b27dcdcb7a62ff5f605440db89e7c14e977d501203d44ad7f36e1e9a45ace

Download Submit
C:\Windows\{30E579C1-AE96-4db6-AD03-66D64111CDC4}.exe

Filesize
197KB

MD5
1bf4c98be1365916fe8bbec5e754b5de

SHA1
4d42a49204879aeeb458ffe15de50b5971e784f8

SHA256
7e2d1591e97b8411a0e2bfaa73642f745d26684777d0c3162f77c87006e6b395

SHA512
679a7b042f72e3503878e7d6e878e3449b57c51b48142faf53f7b581ef21286c7a4730458b4ff815af734b5e386f329affe5957a8dfd1d82f7766889ef2ef1b6

Download Submit
C:\Windows\{3E31524F-7ED1-4898-883B-FF2173F42099}.exe

Filesize
197KB

MD5
233293b014775da0fdb2a73ff2e5e9f5

SHA1
fc86f31bc92ec21dc441a44fd06c183471390915

SHA256
ae0cf7015743975d7ab3d626087ceb4021b81032e74ff47973fcf1c956639da9

SHA512
aac3a3580a1e5389811f75c894f572b69993f1dcb692a2e950337ae4cc07cf3f078a5620ca9d0c7a581c92645f48569f0ffee79f04809e1c64a1a10a7049dd34

Download Submit
C:\Windows\{6B9239FE-A59D-4d87-A496-83043D04D757}.exe

Filesize
197KB

MD5
5ede782c2fa5a5b86ef67a01dd66107f

SHA1
b1d96447a417360f5900e74856b2a49a293697de

SHA256
4ad6570eb15c7a0570e9a99bec2d7bfb5a05488872f2aec644ba1f609a0b7b98

SHA512
00f6f98a25dc90b5da6edc90a51200499ebd6325fcef157ffd9a8c00d2209e81706c996787c4165010c08a35a5a1ff95cc14cea01ade3ea01c9b3cf650fc0409

Download Submit
C:\Windows\{70FF4F5E-5981-47b6-A905-8A42BAC3FB75}.exe

Filesize
197KB

MD5
30804f4fe4b6f55f1495fe3faf160516

SHA1
f482ffc671ff42c421dca9cb577d5b6b6b752e71

SHA256
5a1c6938abce510ea255e70af08c7e10faddb84c85e72bf129719c0d0bb612bb

SHA512
f18cbe5b10f5ed4e73c3b92775812901c14ea8f567ee0517467cb23fa800d36e96429622e939e8c0b58b36335c589fdac2011de7d49f26b0c6044b9faab579c7

Download Submit
C:\Windows\{8EACD7BD-D292-4d58-B90A-F9AC4CF725DF}.exe

Filesize
197KB

MD5
4111903937e05045b46793eb30e84c10

SHA1
1a0ab5b38ce89807c12bd523676d005f893fa972

SHA256
90b006a843cc7fa2e7e90d5f76b5c02ed555d343cccca6e0858428a806f34e8f

SHA512
c229e2909cf0b60fefd4f3a6be0d1de8c105e6eb7e1a9ebe50298d077acef60785f376211b0b47c92ff9cbf7a55f91f8d29cf078dd190199375ec0b5b97e5fbe

Download Submit
C:\Windows\{A05569E9-23C3-4c4f-A38A-80BEF06A4948}.exe

Filesize
197KB

MD5
da27a167460a15976a2be99964eb4b0e

SHA1
ecdedf054e45659efe44a02712b5276fcfbf854a

SHA256
b113470a347bb82eb83225a66b431c015a8ee01d5ff02d3f3bf7113367573f62

SHA512
2ff6419389cc9ae7f4d9ac048883e65fc08f94cdc8bd2f474a613f6969432d64db5ecc98d1df01155db12c17ed378999b2162482938a5eb3edc53ce3aedaf37a

Download Submit
C:\Windows\{C3465EF3-C7FD-4b1c-BCE9-BD041EB08DE9}.exe

Filesize
197KB

MD5
fe2c37d519904b05510390435f2dc565

SHA1
7ed23865169e10afb5ce2065b1b2eef508d89ae2

SHA256
b766dc7de8fa809a9ab1e7cb4633710780e734df86d7427f1b7cc7ca4bd25c42

SHA512
bf6ff599f4a88461cea1d6a0d680d3c01d45f7853098e86aeb10fe928639ef6b6dc715f6f6a7a0067b34d38dad0cc67431402e358f3a0395bd00a459fbc8376c

Download Submit
C:\Windows\{F51A164E-98AE-4cb3-9892-366CA70246A2}.exe

Filesize
197KB

MD5
b7c60e8bfa36b923ae36a875b43dd335

SHA1
7466c18fe597b25810a5b563438e9020d9f8e998

SHA256
8d73889ef32deef592216b10f20e1745a9f81ea2de7dafb28c0252e5f675b471

SHA512
80ff82fa9184fb140f315073c5396f178c668a98bb79654ad31df1d130bdeadb20953c1ae9a6b64c22104ce05a76ac1604ef2bf8b92966538fafe804fdcd9075

Download Submit
C:\Windows\{F7471FC6-60B5-4113-A928-5D6CC4A8B7B4}.exe

Filesize
197KB

MD5
74e233a74ec62368f79221ead92225af

SHA1
1428d0f219c558648391a7489163135efb4bca1e

SHA256
f4cb479f68399963bfc8930323a223348a212663457dd6cf0df89be1b403ac83

SHA512
cbd269fe3fb5bb8f3c7c1c66ee6e718c37ab6dfed1964b790a36c3a92897416821b56c65ee01be7d0d875af200c7831a042c5c7afcc6d0e73f7e6827d6d02b1d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads