1e6039605396bbee327425190158bce3df091a407e571bb66c415acde668ec0d

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
Size

180KB
MD5

b87175affe74cb1305f2d8383826728f
SHA1

6cf29189c1611543ec59113be3c91f7fc29f6536
SHA256

1e6039605396bbee327425190158bce3df091a407e571bb66c415acde668ec0d
SHA512

34558dc0b9bd3d35515eb69eb0263249f1c732698e38fec19998e2433398bbff09c3eb4151d58cceb8d6a51d50f2fa819d4db873c0a407814b673d22f6261233
SSDEEP

3072:jEGh0oSlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGkl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012327-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012256-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000014230-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012256-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012256-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012256-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82635CCE-7B31-4755-BC35-4D76E519982C}	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}\stubpath = "C:\\Windows\\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe"	{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}\stubpath = "C:\\Windows\\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe"	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}\stubpath = "C:\\Windows\\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe"	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}\stubpath = "C:\\Windows\\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe"	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}	{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}\stubpath = "C:\\Windows\\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe"	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}\stubpath = "C:\\Windows\\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe"	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37674D7B-2E39-4c82-965A-7F95DD9E622B}	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{82635CCE-7B31-4755-BC35-4D76E519982C}\stubpath = "C:\\Windows\\{82635CCE-7B31-4755-BC35-4D76E519982C}.exe"	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}\stubpath = "C:\\Windows\\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe"	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{37674D7B-2E39-4c82-965A-7F95DD9E622B}\stubpath = "C:\\Windows\\{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe"	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}	{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}\stubpath = "C:\\Windows\\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe"	{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}\stubpath = "C:\\Windows\\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe"	{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}	{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe

Deletes itself 1 IoCs

pid	Process
2608	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
2656	{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
2076	{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
1992	{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe
836	{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
File created	C:\Windows\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe	{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
File created	C:\Windows\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
File created	C:\Windows\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
File created	C:\Windows\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
File created	C:\Windows\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
File created	C:\Windows\{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
File created	C:\Windows\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
File created	C:\Windows\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
File created	C:\Windows\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe	{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
File created	C:\Windows\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe	{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
Token: SeIncBasePriorityPrivilege	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
Token: SeIncBasePriorityPrivilege	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
Token: SeIncBasePriorityPrivilege	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
Token: SeIncBasePriorityPrivilege	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
Token: SeIncBasePriorityPrivilege	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
Token: SeIncBasePriorityPrivilege	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
Token: SeIncBasePriorityPrivilege	2656	{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
Token: SeIncBasePriorityPrivilege	2076	{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
Token: SeIncBasePriorityPrivilege	1992	{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2324	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	28
PID 1504 wrote to memory of 2324	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	28
PID 1504 wrote to memory of 2324	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	28
PID 1504 wrote to memory of 2324	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	28
PID 1504 wrote to memory of 2608	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	29
PID 1504 wrote to memory of 2608	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	29
PID 1504 wrote to memory of 2608	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	29
PID 1504 wrote to memory of 2608	1504	2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe	29
PID 2324 wrote to memory of 2648	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	30
PID 2324 wrote to memory of 2648	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	30
PID 2324 wrote to memory of 2648	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	30
PID 2324 wrote to memory of 2648	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	30
PID 2324 wrote to memory of 2528	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	31
PID 2324 wrote to memory of 2528	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	31
PID 2324 wrote to memory of 2528	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	31
PID 2324 wrote to memory of 2528	2324	{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe	31
PID 2648 wrote to memory of 2540	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	33
PID 2648 wrote to memory of 2540	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	33
PID 2648 wrote to memory of 2540	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	33
PID 2648 wrote to memory of 2540	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	33
PID 2648 wrote to memory of 2524	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	32
PID 2648 wrote to memory of 2524	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	32
PID 2648 wrote to memory of 2524	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	32
PID 2648 wrote to memory of 2524	2648	{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe	32
PID 2540 wrote to memory of 2476	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	36
PID 2540 wrote to memory of 2476	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	36
PID 2540 wrote to memory of 2476	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	36
PID 2540 wrote to memory of 2476	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	36
PID 2540 wrote to memory of 3000	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	37
PID 2540 wrote to memory of 3000	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	37
PID 2540 wrote to memory of 3000	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	37
PID 2540 wrote to memory of 3000	2540	{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe	37
PID 2476 wrote to memory of 2800	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	38
PID 2476 wrote to memory of 2800	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	38
PID 2476 wrote to memory of 2800	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	38
PID 2476 wrote to memory of 2800	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	38
PID 2476 wrote to memory of 2928	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	39
PID 2476 wrote to memory of 2928	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	39
PID 2476 wrote to memory of 2928	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	39
PID 2476 wrote to memory of 2928	2476	{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe	39
PID 2800 wrote to memory of 1308	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	40
PID 2800 wrote to memory of 1308	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	40
PID 2800 wrote to memory of 1308	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	40
PID 2800 wrote to memory of 1308	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	40
PID 2800 wrote to memory of 1696	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	41
PID 2800 wrote to memory of 1696	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	41
PID 2800 wrote to memory of 1696	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	41
PID 2800 wrote to memory of 1696	2800	{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe	41
PID 1308 wrote to memory of 628	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	42
PID 1308 wrote to memory of 628	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	42
PID 1308 wrote to memory of 628	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	42
PID 1308 wrote to memory of 628	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	42
PID 1308 wrote to memory of 2400	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	43
PID 1308 wrote to memory of 2400	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	43
PID 1308 wrote to memory of 2400	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	43
PID 1308 wrote to memory of 2400	1308	{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe	43
PID 628 wrote to memory of 2656	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	45
PID 628 wrote to memory of 2656	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	45
PID 628 wrote to memory of 2656	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	45
PID 628 wrote to memory of 2656	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	45
PID 628 wrote to memory of 756	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	44
PID 628 wrote to memory of 756	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	44
PID 628 wrote to memory of 756	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	44
PID 628 wrote to memory of 756	628	{82635CCE-7B31-4755-BC35-4D76E519982C}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_b87175affe74cb1305f2d8383826728f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
  C:\Windows\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
    C:\Windows\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{EF758~1.EXE > nul
      4⤵
      PID:2524
  - - C:\Windows\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
      C:\Windows\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Windows\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
        
        C:\Windows\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
        
        C:\Windows\{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
        
        C:\Windows\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
        
        C:\Windows\{82635CCE-7B31-4755-BC35-4D76E519982C}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{82635~1.EXE > nul
        9⤵
        
        PID:756
        
        C:\Windows\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
        
        C:\Windows\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
        
        C:\Windows\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe
        
        C:\Windows\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59DC9~1.EXE > nul
        12⤵
        
        PID:592
        
        C:\Windows\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe
        
        C:\Windows\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe
        12⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B4F0D~1.EXE > nul
        11⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49D6D~1.EXE > nul
        10⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{78B52~1.EXE > nul
        8⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{37674~1.EXE > nul
        7⤵
        
        PID:1696
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{94A7E~1.EXE > nul
        6⤵
        
        PID:2928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C23BC~1.EXE > nul
        5⤵
        
        PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3A62A~1.EXE > nul
    3⤵
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{37674D7B-2E39-4c82-965A-7F95DD9E622B}.exe

Filesize
180KB

MD5
a5c0d9119869265d9e1ddd0ba38043e5

SHA1
aef26813f5b1d46c9740cf3d9d24ecf3dd65dbdd

SHA256
f30dff29aef394e2c1376f69dbf12f9fbdf80a44698b3286f996cbe3298c46a0

SHA512
af9ab66f0d2bc5fa07eb81c2a870a4b2bb7b8f1f910c15363dfdcec813b129cbc1c4a74838a2a521713f289cbfa5b804650de2972f22804fb484778b9f166de0

Download Submit
C:\Windows\{3A62A6A1-E93E-4130-96BF-645F2DFF1E9F}.exe

Filesize
180KB

MD5
d3239557724499a86d6fc9489c9359c0

SHA1
02ad19eab4a4a9339e2cbd6a4136528fdd90ef41

SHA256
9e8a6b1df36aa99dc718520e1f7eb0b5ee5313614d01b1ad5533cdb6f8a8f116

SHA512
82656b256d82c70b14544928b595e19e47780682b741bef6ac1a0c9df641216f49216ad3c2aaf8a0d908e012fd017905403790de3302f3e647f2f024f632c1b6

Download Submit
C:\Windows\{49D6D783-84DA-46e3-8D54-DF9C1C15E073}.exe

Filesize
180KB

MD5
a7e7b48e57f40f3cc79932b2d94f0c36

SHA1
a081cffbc7d7fa996b3996d738d1062fa2b92f1a

SHA256
8a4647f611d038f663e305cb0c693f54afda25decea618bce299e510dfffcf5f

SHA512
aa2ac888c235e90f3842ab1e39ba8cbb3ce1c17eda8adbea4055fd3ea866ad5a36d0bc17d034b722aaca6e0438da4f43d343888a57abcc0a4e4bb02375ca5c21

Download Submit
C:\Windows\{59DC912B-34EF-47e7-8B1A-F110DDB3A77A}.exe

Filesize
180KB

MD5
051fc8c97dda9921a9565a79dfd9a59f

SHA1
aee869e9afd8c655b9f719d5b4d5ae9a8f147057

SHA256
b75211a18673edd8c9149fe2887d9c492b09549d0b055c3de28a937eb0db7ce8

SHA512
92d6aa62dd68cbf4cd5daa3a0bf40c9e193cef27dbe3698c587267a03ae9f2b80acee91b106fe0b219159418cfae9536bbef60ffde4719b4e9dfe6f809e5b2d1

Download Submit
C:\Windows\{78B526A7-4665-4f13-AF5D-D6AFFDE469F0}.exe

Filesize
180KB

MD5
97760325346f90d7aea2116f44145fa5

SHA1
42da2e90c77fd05e5a8bdeb2418367f68d2ec87c

SHA256
2bce0adcdeab85aef95a8571f021d221967f5b0135d1a81a4c6f848d280cd0c6

SHA512
0e7f83c2d8b77e101f1f779a988e248b23c475c478f3e2084fc43a52871fcd991dd9aa4e7fb39ff1a547ced8d4e17ea0d9efde61e3757a342f27a757af3113c1

Download Submit
C:\Windows\{82635CCE-7B31-4755-BC35-4D76E519982C}.exe

Filesize
180KB

MD5
f196f9445787c33e14f8b8fb98f7fa81

SHA1
8c208d8f88bbab075f3fa3d75778597add475e84

SHA256
f896ed835d33580e38a41472623773cef966014b1f1be7efe4226964899a93d7

SHA512
f4fb77ae54b187a126c66085e6b61900dd8e15e4023eed8c9214c1313835975e8057dbd73050fc676de72f97c3b1ad557eda70cb595ed8bbcac41796230782e3

Download Submit
C:\Windows\{94A7ED64-E88E-4ae2-A129-8FE9225A9745}.exe

Filesize
180KB

MD5
cc4a1eb10100dddebdfb2d2cd7bef718

SHA1
cecc24365e395af2d5c25dc5330a209bafbad30a

SHA256
2318e4901b3c4e20a7ed40eb679e0cb7fb17764a1df71f7d589fe277948a5c13

SHA512
515f393fe82b4ca1b26773450d535cf048524ab585cf71dcb945e4cbc3df42ade6ff42fc4ca6369255fef04afbd0d0e60f504ed74c5c731875e53e7d2359d305

Download Submit
C:\Windows\{B4F0D1AF-A04A-4fc5-9C60-1EDB4056F6C7}.exe

Filesize
180KB

MD5
ffe5b8019749bd9b18e66064bde08772

SHA1
efd02825eab1c543cc8f602b4cccac554a35a583

SHA256
e5b55b37cee33d6c2a02fa377a96c309f51ada066bb75ffda2a0b1744bd787c7

SHA512
131974c28b04d71fc814810114a1934b1491fd9b585f3290f1ac9b4a9936f32779dcb06fe69834b912c4401b0a7384f61ab18baebea00ebea6856bc95abd4b59

Download Submit
C:\Windows\{C23BCD0D-81C2-463d-ABF0-7EE74176A9BB}.exe

Filesize
180KB

MD5
db388c3b29e7e34c55edfa419a92a1f7

SHA1
eefaa28d4f22e50cf77c0469d2b293685cfc4278

SHA256
a3d730d8f89f428bb59105ecacb26f675058cffa318d3e3ebb3d9164d2e9602d

SHA512
c038f5f7afaf1a28773ed9db3f183a38159842713bc81a654e1520de26ff6e547a6c42f174bce6cd44221d3bb3f7400b88493cad050a9eebea4fd02212ed1aa8

Download Submit
C:\Windows\{D463CC04-DDFC-4bd1-A68C-B686DCF16D39}.exe

Filesize
180KB

MD5
0282b9084e325ed3577789afd005d5cd

SHA1
5470d051e2f6e27d290973e0776f19f274325eb1

SHA256
a02b4750b60e278bfe6382012e20aaa0cbb968a6a08036d11fd33903a7484467

SHA512
8794922b6ba50a1dd9b9e9fe085c9225b82022b7f6cfdc48f63fb306e229ba2b1d591ece0fe178b8f5aed7aed84eace599d19974d483de9d21d8f2487390a85d

Download Submit
C:\Windows\{EF7580A0-F305-4078-9FF5-35A8C15DACDB}.exe

Filesize
180KB

MD5
54595311cba78fd9878c01a19c50350b

SHA1
2c3c99b3ec2cc66fc8dd2b1ddef35873a3debe9d

SHA256
46bf3a7d12323f33ed10246570f0143cca7e4115fb399552a12bf2055075c64e

SHA512
b9504ef0bec420385cd349ce1f639fd5e5b0207f19a605844f8b9ff37ded0948e9ae058648dcdeef6e761e3ae38965865f77240dfab1e66281ff72733937f29b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads