cada12268686abad041381b6ae5b6f5afb5245f57bf9781e5053ecdbdcf11174

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
Size

204KB
MD5

00ab29d8d05cbf256e67f37b3fa822dc
SHA1

d94aaa931d86c801557682ae025025b26fe27df7
SHA256

cada12268686abad041381b6ae5b6f5afb5245f57bf9781e5053ecdbdcf11174
SHA512

bf20a2b17ea551b8ffb29c0f027f1e9e3d2096bad490bd8f44164bc087abbe4eaae45f3bb7fc93ec8236be3a051e5337faae0ba9a418691a2fdb8a196408180d
SSDEEP

1536:1EGh0oMl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oMl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001231a-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000001431c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001231a-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000014502-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001231a-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001231a-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-62.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001231a-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001231a-69.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0F07A615-2314-4595-BF0D-E22EE1C08B43}	{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E36CD58-1A8C-4872-9A80-180430422A9B}	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E36CD58-1A8C-4872-9A80-180430422A9B}\stubpath = "C:\\Windows\\{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe"	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CB84783-D837-4e1b-B078-C1C710B77669}	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}\stubpath = "C:\\Windows\\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe"	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}\stubpath = "C:\\Windows\\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe"	{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9749041-BD17-422f-AB22-B8CC173B8BF9}	{43230D19-F4F6-4006-90F9-740D4740A493}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}\stubpath = "C:\\Windows\\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe"	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}\stubpath = "C:\\Windows\\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe"	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}	{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{283DB530-958C-443a-BF5F-382D2CCA86C2}	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{283DB530-958C-443a-BF5F-382D2CCA86C2}\stubpath = "C:\\Windows\\{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe"	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CB84783-D837-4e1b-B078-C1C710B77669}\stubpath = "C:\\Windows\\{4CB84783-D837-4e1b-B078-C1C710B77669}.exe"	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43230D19-F4F6-4006-90F9-740D4740A493}	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F9749041-BD17-422f-AB22-B8CC173B8BF9}\stubpath = "C:\\Windows\\{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe"	{43230D19-F4F6-4006-90F9-740D4740A493}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}	{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}\stubpath = "C:\\Windows\\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe"	{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43230D19-F4F6-4006-90F9-740D4740A493}\stubpath = "C:\\Windows\\{43230D19-F4F6-4006-90F9-740D4740A493}.exe"	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0F07A615-2314-4595-BF0D-E22EE1C08B43}\stubpath = "C:\\Windows\\{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe"	{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe

Deletes itself 1 IoCs

pid	Process
2912	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe
2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
1696	{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
2564	{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
2956	{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe
584	{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
File created	C:\Windows\{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
File created	C:\Windows\{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	{43230D19-F4F6-4006-90F9-740D4740A493}.exe
File created	C:\Windows\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
File created	C:\Windows\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
File created	C:\Windows\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe	{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
File created	C:\Windows\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe	{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
File created	C:\Windows\{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
File created	C:\Windows\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
File created	C:\Windows\{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe	{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe
File created	C:\Windows\{43230D19-F4F6-4006-90F9-740D4740A493}.exe	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
Token: SeIncBasePriorityPrivilege	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
Token: SeIncBasePriorityPrivilege	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
Token: SeIncBasePriorityPrivilege	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe
Token: SeIncBasePriorityPrivilege	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
Token: SeIncBasePriorityPrivilege	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
Token: SeIncBasePriorityPrivilege	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
Token: SeIncBasePriorityPrivilege	1696	{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
Token: SeIncBasePriorityPrivilege	2564	{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
Token: SeIncBasePriorityPrivilege	2956	{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1028	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	28
PID 2316 wrote to memory of 1028	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	28
PID 2316 wrote to memory of 1028	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	28
PID 2316 wrote to memory of 1028	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	28
PID 2316 wrote to memory of 2912	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	29
PID 2316 wrote to memory of 2912	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	29
PID 2316 wrote to memory of 2912	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	29
PID 2316 wrote to memory of 2912	2316	2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe	29
PID 1028 wrote to memory of 2716	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	30
PID 1028 wrote to memory of 2716	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	30
PID 1028 wrote to memory of 2716	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	30
PID 1028 wrote to memory of 2716	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	30
PID 1028 wrote to memory of 2928	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	31
PID 1028 wrote to memory of 2928	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	31
PID 1028 wrote to memory of 2928	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	31
PID 1028 wrote to memory of 2928	1028	{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe	31
PID 2716 wrote to memory of 2492	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	32
PID 2716 wrote to memory of 2492	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	32
PID 2716 wrote to memory of 2492	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	32
PID 2716 wrote to memory of 2492	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	32
PID 2716 wrote to memory of 2504	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	33
PID 2716 wrote to memory of 2504	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	33
PID 2716 wrote to memory of 2504	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	33
PID 2716 wrote to memory of 2504	2716	{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe	33
PID 2492 wrote to memory of 3068	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	36
PID 2492 wrote to memory of 3068	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	36
PID 2492 wrote to memory of 3068	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	36
PID 2492 wrote to memory of 3068	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	36
PID 2492 wrote to memory of 2356	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	37
PID 2492 wrote to memory of 2356	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	37
PID 2492 wrote to memory of 2356	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	37
PID 2492 wrote to memory of 2356	2492	{4CB84783-D837-4e1b-B078-C1C710B77669}.exe	37
PID 3068 wrote to memory of 2868	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	38
PID 3068 wrote to memory of 2868	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	38
PID 3068 wrote to memory of 2868	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	38
PID 3068 wrote to memory of 2868	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	38
PID 3068 wrote to memory of 2900	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	39
PID 3068 wrote to memory of 2900	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	39
PID 3068 wrote to memory of 2900	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	39
PID 3068 wrote to memory of 2900	3068	{43230D19-F4F6-4006-90F9-740D4740A493}.exe	39
PID 2868 wrote to memory of 1996	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	41
PID 2868 wrote to memory of 1996	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	41
PID 2868 wrote to memory of 1996	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	41
PID 2868 wrote to memory of 1996	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	41
PID 2868 wrote to memory of 816	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	40
PID 2868 wrote to memory of 816	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	40
PID 2868 wrote to memory of 816	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	40
PID 2868 wrote to memory of 816	2868	{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe	40
PID 1996 wrote to memory of 1444	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	43
PID 1996 wrote to memory of 1444	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	43
PID 1996 wrote to memory of 1444	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	43
PID 1996 wrote to memory of 1444	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	43
PID 1996 wrote to memory of 2452	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	42
PID 1996 wrote to memory of 2452	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	42
PID 1996 wrote to memory of 2452	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	42
PID 1996 wrote to memory of 2452	1996	{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe	42
PID 1444 wrote to memory of 1696	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	44
PID 1444 wrote to memory of 1696	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	44
PID 1444 wrote to memory of 1696	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	44
PID 1444 wrote to memory of 1696	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	44
PID 1444 wrote to memory of 1624	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	45
PID 1444 wrote to memory of 1624	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	45
PID 1444 wrote to memory of 1624	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	45
PID 1444 wrote to memory of 1624	1444	{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_00ab29d8d05cbf256e67f37b3fa822dc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
  C:\Windows\{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
    C:\Windows\{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
      C:\Windows\{4CB84783-D837-4e1b-B078-C1C710B77669}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\{43230D19-F4F6-4006-90F9-740D4740A493}.exe
        
        C:\Windows\{43230D19-F4F6-4006-90F9-740D4740A493}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Windows\{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
        
        C:\Windows\{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9749~1.EXE > nul
        7⤵
        
        PID:816
        
        C:\Windows\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
        
        C:\Windows\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C54F~1.EXE > nul
        8⤵
        
        PID:2452
        
        C:\Windows\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
        
        C:\Windows\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
        
        C:\Windows\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
        
        C:\Windows\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe
        
        C:\Windows\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
        
        C:\Windows\{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe
        
        C:\Windows\{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe
        12⤵
        Executes dropped EXE
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FC02E~1.EXE > nul
        12⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58E1C~1.EXE > nul
        11⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A364~1.EXE > nul
        10⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25F8D~1.EXE > nul
        9⤵
        
        PID:1624
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{43230~1.EXE > nul
        6⤵
        
        PID:2900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4CB84~1.EXE > nul
        5⤵
        
        PID:2356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5E36C~1.EXE > nul
      4⤵
      PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{283DB~1.EXE > nul
    3⤵
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0F07A615-2314-4595-BF0D-E22EE1C08B43}.exe

Filesize
204KB

MD5
1c0d2e22b2493c2361fc8387b3f9cb82

SHA1
5bd8070aa9f9e23665255ecc3395f52c28b078ca

SHA256
09e419fc283ea12d76d76fdeedce9a2fa736314a4e6a2b424d359ad5a6f99b17

SHA512
cb0f04d51b9d645fce06afe1d223585dccd9f9263b107fd84c374916bfd3b999716880c414f429108baae046ceb03d6c09c5c10d25cffe9e929c659b3adb5e60

Download Submit
C:\Windows\{25F8D999-8E3C-4d93-A6D1-2659623E59C8}.exe

Filesize
204KB

MD5
826c01b9ad0fc95af50fe3edb337dcec

SHA1
5aeb8b768d9c617adf4540da32a3a4a48a2d7689

SHA256
5905c6cba11512f00ab3272ad3a7af490820bdc089c262a94c5d45661459d1bc

SHA512
f58a519d424b1d9f40092e8000f6491134af8bf141d29f64520b25201c8ee417575fe6eae87c2500dbe063f294f75206484732f0d5f7543cb2d12ee2663e1fcb

Download Submit
C:\Windows\{283DB530-958C-443a-BF5F-382D2CCA86C2}.exe

Filesize
204KB

MD5
440f004b5e21867e48300b90431ae009

SHA1
ee4fd89392f39cf9ba4fceaa44fbcc80864d45a4

SHA256
80027b13397a4d8328b16d61398cf9fa7b18c5630f8c9a3557d51f16ea64e757

SHA512
4a238d67bac59fcc42bd27d19dcea56381033de832ae3e27b181f105b228be991bacbf5598d9f035f8f4be41eee92f54efe04674aec5b4e772e55b460b292229

Download Submit
C:\Windows\{3C54FE7F-2ABA-41fe-B6ED-F236A37239D9}.exe

Filesize
204KB

MD5
7fea4af92f11fdc932efe96625a5f648

SHA1
e90080ee78707d9c6ceb9776a7ca61e3556adee5

SHA256
0ab5f29fde39ec73f9ebf175cd2b28837bb3536d398857b3a144ae11f92402e8

SHA512
40245d6337d709481242f8100f9ae88aed28b05c14bacb67f17202e66612dfb372047663a720ba479bb31b0e5f085807fb9005c1814e2732d2e3e4effccf24ee

Download Submit
C:\Windows\{43230D19-F4F6-4006-90F9-740D4740A493}.exe

Filesize
204KB

MD5
58cf82fe7205a23a26876247bc4581da

SHA1
d222def9bc679d33d0610da8a3c5eac53ee158be

SHA256
380c84b699655892514fac29542de3b91473c1ddc7b5494c71ad0efbd1aa227e

SHA512
42cd173d87c4caa320a78ed80e245e976fa9f8f49c88f99409d1871e71036093de5105e1b6e1589d1aaafe0256cdf95d408e4b6157a1667c1f66e0e487acd8e7

Download Submit
C:\Windows\{4CB84783-D837-4e1b-B078-C1C710B77669}.exe

Filesize
204KB

MD5
fb1ac227c97e421d47aed1c28e243e45

SHA1
4871a3ee9c3c7af4e36d0edcbb15e32458d4aa25

SHA256
0379e5fe8a79d7b5b36e7c01c30d7e83a4e0465bfc1ad4a29b4410de0b777080

SHA512
a8ab83de1a1549ff2f0cccac6e6af9cccc910ec9fae4f30e3ad1d3a14739452dffa6be1d9d2cdf363d0ee5cb1a00269661f11c86275a580b79fe0f0f33ce4bd2

Download Submit
C:\Windows\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe

Filesize
204KB

MD5
233f3b36d4db7ea89f42fd6a50751569

SHA1
ed6e0a1e500c4962c59b0201cd1e6a4ad6e73754

SHA256
fa26ee4f44a28e297f8e97fc8ce0d1d3ce0b9656389f19ba4b9a0de9e7802aa4

SHA512
9875ef0e43539e0f04323085a15137715408e6db32b66788a30a0c4d410afe3234ce75a138700d37e0c5274162981b1ddd7e42f4cf253a63624187a7a6ae31bd

Download Submit
C:\Windows\{58E1CA7B-8AF6-462b-9111-44AFF78C443A}.exe

Filesize
136KB

MD5
a04a94c801aa7e39b15a60037bdf1278

SHA1
eae353be4604c579d4c729dee2260f7cbf4d8136

SHA256
aca7b8385a158db3019cb33b1bbc294743ea5249fc0ba60b499972e10a2badb2

SHA512
3390ce3fa4b7975b3b868082da3c71a2b672b58876604a9f0781317e17151bde120f707fd9f18faf02e75d8f4a717095a4f954ea975f57f99f3fa6d2e5aea861

Download Submit
C:\Windows\{5E36CD58-1A8C-4872-9A80-180430422A9B}.exe

Filesize
204KB

MD5
3929e43d4c251f2337995e448e5a2f18

SHA1
1ea61f8561f2cdf69fa594cb77b8c91324049044

SHA256
c2393f22bf3b81402e0c4e1eaba72dc23f987b66e1b988eca97e7ec9621b001e

SHA512
845ce84f85a4482b07a0abcfc03d046a77e2168879f0cfe4fac262520753c07b7ff393e01c544ee40819f0f361ace2cf9977c04c8cfb8f4dab9b436088192a33

Download Submit
C:\Windows\{6A3642C0-CFA3-4cf0-AC61-4B89B4B7B03C}.exe

Filesize
204KB

MD5
cb0293e9870e581c8527373a5ae7f555

SHA1
82ab89f9f7af6f5e0e19198713b2e97b4fd37695

SHA256
26721daf4e474eeae9a740be115b283dd625d2c6ab288d3d8b6c9a7767268101

SHA512
cc31bd9f15382a1fe4de5da16690e9b6c52761369c97eaca42d2a9a112d957629b1d975d9c97db929e8dbbedd24aad28f88a0ec517e0c8ce12eddbc47877053d

Download Submit
C:\Windows\{F9749041-BD17-422f-AB22-B8CC173B8BF9}.exe

Filesize
204KB

MD5
a338f23513e414ae6ea0c3764aa419bb

SHA1
163450757ada4fe7239045c5d2cfb0cbc54467f0

SHA256
2a9567ccf22c0471160a400db10f29fe62da69c08d978507fed377c2344b429d

SHA512
6c8654df1058bafe607149022279c674251c6afab4563911882e4f0fea9a4486762f11cccfa262c2971c2a61d011fac553dc15743f8ff5ce77066da56383aaa4

Download Submit
C:\Windows\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe

Filesize
64KB

MD5
30bb2506620b6c31cf5ed69d92a49140

SHA1
30b2487bb67c6996ddb599d1c3cb89a6466ea04c

SHA256
afc1c10f1b3cf581642c2457bc85094d2430a8da5cee47f89f8cfc3eebe6d36e

SHA512
315f4aec43654bc859d804a04a7c7a9958fc34ea6ddeb9294f317faf1823485eb74dacad2c3461bf30de111c8fa732180422959a9a6789040daf90342e018579

Download Submit
C:\Windows\{FC02EC45-7E03-4ae7-B1D4-BBEA6518F84A}.exe

Filesize
204KB

MD5
f09b0c51c2f8fb22517bd2a4a7e3adb0

SHA1
13e9fd065521bab1821a357a0f1b3bb669efe380

SHA256
9eea79efe10d5a6ee9fc3c5d5f8cf872638f3c83490fee2a5ac18c874a3d26b7

SHA512
b5eaffefe0d17fe6506e0f2979dd836c700e91d91ce1f0fcd90d01e9de3a74ae5b510627e93408981502859dc189cada00f54791123fb39afef0112805f87dae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads