b0275712a85ca0a5117febe4d7f1e6bdd819360c95595784a18effd26c9244db

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
Size

168KB
MD5

db435dd7189fa75b8dc97ce4e36f90a5
SHA1

d444c8025c30c10c95904404c3bb6482630b7047
SHA256

b0275712a85ca0a5117febe4d7f1e6bdd819360c95595784a18effd26c9244db
SHA512

3490f578519595314ed2763734eeb2ee785e67e98a71b22672ea57ab6f116a6a3886ba339c633263a049fbffec67b0a804811d4578066517c951b4691983987a
SSDEEP

1536:1EGh0omlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0omlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232e-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000013309-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001232e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x003a0000000139f1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001232e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001232e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-62.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001232e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22A8A854-F76A-49b6-B76E-DA3B2D527795}\stubpath = "C:\\Windows\\{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe"	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}\stubpath = "C:\\Windows\\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe"	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B367F91-A65B-46b2-8B97-779E734B6BF3}	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}	{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85A42440-3F8E-458f-BAAE-EC02CA81E137}\stubpath = "C:\\Windows\\{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe"	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95DB04F7-7828-4700-975C-22A5D1696E10}	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BA3A015-CA49-4423-AB12-977EEBE0F702}	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22A8A854-F76A-49b6-B76E-DA3B2D527795}	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95DB04F7-7828-4700-975C-22A5D1696E10}\stubpath = "C:\\Windows\\{95DB04F7-7828-4700-975C-22A5D1696E10}.exe"	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}\stubpath = "C:\\Windows\\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe"	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}	{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}\stubpath = "C:\\Windows\\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe"	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6B367F91-A65B-46b2-8B97-779E734B6BF3}\stubpath = "C:\\Windows\\{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe"	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15BDE677-D8D9-49ea-BE55-E00B940354B1}	{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{15BDE677-D8D9-49ea-BE55-E00B940354B1}\stubpath = "C:\\Windows\\{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe"	{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}\stubpath = "C:\\Windows\\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe"	{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85A42440-3F8E-458f-BAAE-EC02CA81E137}	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BA3A015-CA49-4423-AB12-977EEBE0F702}\stubpath = "C:\\Windows\\{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe"	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}\stubpath = "C:\\Windows\\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe"	{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe

Deletes itself 1 IoCs

pid	Process
1316	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
2652	{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
1536	{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
2832	{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
700	{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
File created	C:\Windows\{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
File created	C:\Windows\{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
File created	C:\Windows\{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
File created	C:\Windows\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe	{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
File created	C:\Windows\{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe	{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
File created	C:\Windows\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe	{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
File created	C:\Windows\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
File created	C:\Windows\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
File created	C:\Windows\{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
File created	C:\Windows\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
Token: SeIncBasePriorityPrivilege	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
Token: SeIncBasePriorityPrivilege	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
Token: SeIncBasePriorityPrivilege	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
Token: SeIncBasePriorityPrivilege	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
Token: SeIncBasePriorityPrivilege	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
Token: SeIncBasePriorityPrivilege	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
Token: SeIncBasePriorityPrivilege	2652	{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
Token: SeIncBasePriorityPrivilege	1536	{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
Token: SeIncBasePriorityPrivilege	2832	{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2336	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	28
PID 1724 wrote to memory of 2336	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	28
PID 1724 wrote to memory of 2336	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	28
PID 1724 wrote to memory of 2336	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	28
PID 1724 wrote to memory of 1316	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	29
PID 1724 wrote to memory of 1316	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	29
PID 1724 wrote to memory of 1316	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	29
PID 1724 wrote to memory of 1316	1724	2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe	29
PID 2336 wrote to memory of 2680	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	30
PID 2336 wrote to memory of 2680	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	30
PID 2336 wrote to memory of 2680	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	30
PID 2336 wrote to memory of 2680	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	30
PID 2336 wrote to memory of 2552	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	31
PID 2336 wrote to memory of 2552	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	31
PID 2336 wrote to memory of 2552	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	31
PID 2336 wrote to memory of 2552	2336	{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe	31
PID 2680 wrote to memory of 2704	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	33
PID 2680 wrote to memory of 2704	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	33
PID 2680 wrote to memory of 2704	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	33
PID 2680 wrote to memory of 2704	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	33
PID 2680 wrote to memory of 1400	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	32
PID 2680 wrote to memory of 1400	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	32
PID 2680 wrote to memory of 1400	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	32
PID 2680 wrote to memory of 1400	2680	{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe	32
PID 2704 wrote to memory of 3000	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	36
PID 2704 wrote to memory of 3000	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	36
PID 2704 wrote to memory of 3000	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	36
PID 2704 wrote to memory of 3000	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	36
PID 2704 wrote to memory of 1324	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	37
PID 2704 wrote to memory of 1324	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	37
PID 2704 wrote to memory of 1324	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	37
PID 2704 wrote to memory of 1324	2704	{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe	37
PID 3000 wrote to memory of 2780	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	38
PID 3000 wrote to memory of 2780	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	38
PID 3000 wrote to memory of 2780	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	38
PID 3000 wrote to memory of 2780	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	38
PID 3000 wrote to memory of 2896	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	39
PID 3000 wrote to memory of 2896	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	39
PID 3000 wrote to memory of 2896	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	39
PID 3000 wrote to memory of 2896	3000	{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe	39
PID 2780 wrote to memory of 2872	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	40
PID 2780 wrote to memory of 2872	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	40
PID 2780 wrote to memory of 2872	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	40
PID 2780 wrote to memory of 2872	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	40
PID 2780 wrote to memory of 1980	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	41
PID 2780 wrote to memory of 1980	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	41
PID 2780 wrote to memory of 1980	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	41
PID 2780 wrote to memory of 1980	2780	{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe	41
PID 2872 wrote to memory of 2132	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	42
PID 2872 wrote to memory of 2132	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	42
PID 2872 wrote to memory of 2132	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	42
PID 2872 wrote to memory of 2132	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	42
PID 2872 wrote to memory of 2376	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	43
PID 2872 wrote to memory of 2376	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	43
PID 2872 wrote to memory of 2376	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	43
PID 2872 wrote to memory of 2376	2872	{95DB04F7-7828-4700-975C-22A5D1696E10}.exe	43
PID 2132 wrote to memory of 2652	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	44
PID 2132 wrote to memory of 2652	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	44
PID 2132 wrote to memory of 2652	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	44
PID 2132 wrote to memory of 2652	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	44
PID 2132 wrote to memory of 1876	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	45
PID 2132 wrote to memory of 1876	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	45
PID 2132 wrote to memory of 1876	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	45
PID 2132 wrote to memory of 1876	2132	{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_db435dd7189fa75b8dc97ce4e36f90a5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
  C:\Windows\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
    C:\Windows\{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{85A42~1.EXE > nul
      4⤵
      PID:1400
  - - C:\Windows\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
      C:\Windows\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
        
        C:\Windows\{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Windows\{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
        
        C:\Windows\{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
        
        C:\Windows\{95DB04F7-7828-4700-975C-22A5D1696E10}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
        
        C:\Windows\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
        
        C:\Windows\{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
        
        C:\Windows\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
        
        C:\Windows\{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{15BDE~1.EXE > nul
        12⤵
        
        PID:1092
        
        C:\Windows\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe
        
        C:\Windows\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe
        12⤵
        Executes dropped EXE
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0BDAD~1.EXE > nul
        11⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9BA3A~1.EXE > nul
        10⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A913~1.EXE > nul
        9⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95DB0~1.EXE > nul
        8⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{22A8A~1.EXE > nul
        7⤵
        
        PID:1980
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6B367~1.EXE > nul
        6⤵
        
        PID:2896
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B906~1.EXE > nul
        5⤵
        
        PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FF02A~1.EXE > nul
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe

Filesize
168KB

MD5
5855b56140a0b01f45f6e4bd27f76b33

SHA1
45a7d7e89685157f363af4361af17d8b57b39ae0

SHA256
01d1d301e1e7ffbf8c9b9faadfdc3cfb47d6f435d3a7b032b3316e8cd351ce15

SHA512
71e1573cd7c9191e28c25f6cb71241a70015f8410adddc1a7df97dd33fc21a879ba52ec7efb6b55254352751a2446ffcf98a83e9740d83e46a534accbf4e6ee5

Download Submit
C:\Windows\{0BDADED2-1A04-4d17-953A-871FDA93BE8A}.exe

Filesize
27KB

MD5
ac55a7b47c15edf178dfc1d263dfbfdd

SHA1
d217c3f6c486b0e76aa041a3bdae56916e2c6a22

SHA256
70ee66feed006f8596999f7d83b0044ef19dc706fd9e99084bfe5e11f7714ff6

SHA512
6cdab9bcc78e70e8f3ac82849bf4e4e58b54b120d84548667df659b2f982ef7251e39da7f3b02a4d4373ca70269e16404038bd6a687dd04d60966a26fc191e8e

Download Submit
C:\Windows\{15BDE677-D8D9-49ea-BE55-E00B940354B1}.exe

Filesize
168KB

MD5
b29867417116718be81fcf0840283f9d

SHA1
23220d42dc4f8d59148fd5456235053e32040aca

SHA256
69692417d88c109ea27ababf179ae8bf4680843ddb0faf939b00b9dfedd54155

SHA512
4696379d28ba65a65b43bbf7da023e8bf5bf3b1c3b2162ab918e3ad574091d4427aeb269127d473c81730dc6c4e338ad6e5231ff58b0fb803c54dbb061847faa

Download Submit
C:\Windows\{1A9130AC-7FAB-4496-97DE-C49E332C78F5}.exe

Filesize
168KB

MD5
4bc22e79c1a91148c5be8fcc6af8467e

SHA1
55950e0630aae96ab1adc2fab560c942df2341d2

SHA256
88beebc353997f14f8e53e5fb12da4221db6fcd55e2e7f5d141355e951f9ad59

SHA512
8a7cae1e179de205c43659305382d736e0dff850a638eddfdc729504dba4b28c5419df62f720655680010fa7e2f53863a2614312c7c44f33b6e802bef0f87081

Download Submit
C:\Windows\{22A8A854-F76A-49b6-B76E-DA3B2D527795}.exe

Filesize
168KB

MD5
0d017414d75d92d664dbbe96f19c5611

SHA1
55a7f748580f5e0cead666395446ddf316fa2b3a

SHA256
7df795f2f0fcb787434b385de95eead6231ba69bde8bfc327076e1264a4867aa

SHA512
0f27e54d79c4d3402c926e5235b87fc5c441145f63a2bbe3b602709eb7ee2b28b859a5da832a6cbc1235b0362dd2a1c0b61379cccc75d507790b45371032a72d

Download Submit
C:\Windows\{3B906A2C-586E-447b-8BC3-A62AD4AB1BDB}.exe

Filesize
168KB

MD5
545a0b8212ff7fc184e70bcd96699f24

SHA1
fb9ff566465a93d10c5069a3e8b6588058ec1cd8

SHA256
04bb8db9a226bb52288e39f961b585e508d79e1a0ecf9ba722e4ab06cb81f676

SHA512
b4f0aef864dafbd67e358843d185e98bb944c70b39309ad35f415736681b0d5cda643e7f523d5e837951774ec5edf3e0daae9150e0be0e4c4444661d7740a5de

Download Submit
C:\Windows\{6B367F91-A65B-46b2-8B97-779E734B6BF3}.exe

Filesize
168KB

MD5
577ee549bd26258f44fd2776f262007f

SHA1
11673f2ed3b2b013554bd07ad84c43485976b00a

SHA256
381d03d8dbef0407de3b20caa6a12cf4650478b52537ae89dd89a25a8b01f26a

SHA512
32d740238729a5dabc85fce71e59fd2e0dd96a0dffd51573bc5dbccc5be0ad6f54ef67f25cb141dac7338d73dd40918f45dcd254c785b8ab68438e853fb97f43

Download Submit
C:\Windows\{85A42440-3F8E-458f-BAAE-EC02CA81E137}.exe

Filesize
168KB

MD5
10d8e46ef18490acb770937fa48ec2a0

SHA1
5e399b634ad81272ff9abe5902c409619383d6bd

SHA256
cdb205579ced7f7ac8b4e199d5364950bb579e222235a42bc251e3633e826ad6

SHA512
42fb426c17c313003c53c3cc4ba7f4eb3d58f6af1841622a780f3f90d8018591664bf1f66427cecb1d2fc056fef6bf9bda2b28f7a1d12a9938a4ad3ff551c216

Download Submit
C:\Windows\{95DB04F7-7828-4700-975C-22A5D1696E10}.exe

Filesize
168KB

MD5
8bb57cc632b81e301b3d0a27650939bf

SHA1
ae4fafd68551db369eac2026725bd42cc637c713

SHA256
b90098628d0a35282b91f230a7ee7b9e4905cd7d76e47ec0a810d0b039d0377c

SHA512
e3799838402d9100d1ceb4b4d7345dc9097ad936e4161fab5832716dea7dc3c775786deaba9166bf4ad04c74bec86270a47f1d0ada95bcc5c98aa9cf70babdff

Download Submit
C:\Windows\{9BA3A015-CA49-4423-AB12-977EEBE0F702}.exe

Filesize
168KB

MD5
4f319a8e7c95407cedca7f960012fabc

SHA1
efcd5c344eb405b94f626ac4faff3d798c288340

SHA256
5cff29382ea337e5b02563e622b03b73cbce155e957e6618bab4d73daeb03add

SHA512
d8015a389545c6f632a3544c38b35715ba9e8de460c44ee8caedf4a2fb55a3dd458b8155d7452699d54e73ebf6d806c8ffe5acf7f6ac279874f53c373648b185

Download Submit
C:\Windows\{CCFA0A1E-83A8-4dc7-871B-BD6BB8A739A8}.exe

Filesize
168KB

MD5
65afaa24eaf7d437898514e306104cce

SHA1
8bdf32c8e14f53abb777a7eb2b6fc2acd0206256

SHA256
a879c5e8095b717311962d7218c039e6f5a89d2abd031924152306d698b535b2

SHA512
5003728cc8edce101d5d8636b28c6cb83962fed6bcbe6c0a2e07b70d134a7cabe8f6b2a4ce74e666d405261647fb4aa56c90a7ad210e5e192e86c8bc20491361

Download Submit
C:\Windows\{FF02A9A9-8653-41a5-B1A4-685B2DCE7F95}.exe

Filesize
168KB

MD5
1a0adb2106d6a248c0b0b1268e557af5

SHA1
f312d2d18ae6fe38a390477269a9a36b5c7c6265

SHA256
7a74bb75d33856907d2c49e36d3dbd9a33d987cccda2bde6e984c4e92d09d9a3

SHA512
92733adc060dd471bf0ce2ff70bd44e1939415ec3256642569eb6e1d5cbc207bdc65a3a77f557b361150db5e07d3a2388a2f33d3d499fd38f6b51c4d725d6d4e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads