1783e0325fca91b73a56961d301bcbd451ab0392613d54e0393fd0f3b3fd1d00

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Size

380KB
MD5

ee8677e786d37814a7200bf9e430c69e
SHA1

cfc28d1d0223cb0d18ead6b421645828509c7783
SHA256

1783e0325fca91b73a56961d301bcbd451ab0392613d54e0393fd0f3b3fd1d00
SHA512

692e41c25005a3d11705506708581881d1b87aefcdbd83adba254bd7754ef31c282ea71265617a70f19f0c30f35f746e9b3a1479405ad8aaff2cb2e3beb8bba3
SSDEEP

3072:mEGh0oHlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGxl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012248-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000136fc-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012248-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000015d06-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012248-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012248-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012248-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D62699D-D54B-4900-AB28-471E50427F85}	{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B310FD26-44EE-425b-AFB6-198CAEFB295D}\stubpath = "C:\\Windows\\{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe"	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{363EDD10-D92F-4cfe-B069-73FA60301682}	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}\stubpath = "C:\\Windows\\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe"	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{199F2F83-BDD6-4014-9DFF-F604A457E096}\stubpath = "C:\\Windows\\{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe"	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{591E26C1-089B-4b88-9486-C05DB45E7EA2}\stubpath = "C:\\Windows\\{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe"	{0D62699D-D54B-4900-AB28-471E50427F85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22BBA863-7BF7-429c-B128-4F7211F047D4}	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{363EDD10-D92F-4cfe-B069-73FA60301682}\stubpath = "C:\\Windows\\{363EDD10-D92F-4cfe-B069-73FA60301682}.exe"	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A856996-7780-48cd-BEF1-0AD68F964028}	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}\stubpath = "C:\\Windows\\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe"	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{199F2F83-BDD6-4014-9DFF-F604A457E096}	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73906558-53C7-4d92-8D07-DECF7B947CAD}	{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73906558-53C7-4d92-8D07-DECF7B947CAD}\stubpath = "C:\\Windows\\{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe"	{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22BBA863-7BF7-429c-B128-4F7211F047D4}\stubpath = "C:\\Windows\\{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe"	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A856996-7780-48cd-BEF1-0AD68F964028}\stubpath = "C:\\Windows\\{4A856996-7780-48cd-BEF1-0AD68F964028}.exe"	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0D62699D-D54B-4900-AB28-471E50427F85}\stubpath = "C:\\Windows\\{0D62699D-D54B-4900-AB28-471E50427F85}.exe"	{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{591E26C1-089B-4b88-9486-C05DB45E7EA2}	{0D62699D-D54B-4900-AB28-471E50427F85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B310FD26-44EE-425b-AFB6-198CAEFB295D}	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}\stubpath = "C:\\Windows\\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe"	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe

Deletes itself 1 IoCs

pid	Process
2964	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
496	{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
2112	{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
2100	{0D62699D-D54B-4900-AB28-471E50427F85}.exe
580	{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
File created	C:\Windows\{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
File created	C:\Windows\{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
File created	C:\Windows\{0D62699D-D54B-4900-AB28-471E50427F85}.exe	{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
File created	C:\Windows\{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
File created	C:\Windows\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
File created	C:\Windows\{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
File created	C:\Windows\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
File created	C:\Windows\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
File created	C:\Windows\{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe	{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
File created	C:\Windows\{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe	{0D62699D-D54B-4900-AB28-471E50427F85}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
Token: SeIncBasePriorityPrivilege	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
Token: SeIncBasePriorityPrivilege	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
Token: SeIncBasePriorityPrivilege	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
Token: SeIncBasePriorityPrivilege	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
Token: SeIncBasePriorityPrivilege	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
Token: SeIncBasePriorityPrivilege	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
Token: SeIncBasePriorityPrivilege	496	{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
Token: SeIncBasePriorityPrivilege	2112	{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
Token: SeIncBasePriorityPrivilege	2100	{0D62699D-D54B-4900-AB28-471E50427F85}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1648	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	28
PID 1756 wrote to memory of 1648	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	28
PID 1756 wrote to memory of 1648	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	28
PID 1756 wrote to memory of 1648	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	28
PID 1756 wrote to memory of 2964	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	29
PID 1756 wrote to memory of 2964	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	29
PID 1756 wrote to memory of 2964	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	29
PID 1756 wrote to memory of 2964	1756	2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe	29
PID 1648 wrote to memory of 2604	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	30
PID 1648 wrote to memory of 2604	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	30
PID 1648 wrote to memory of 2604	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	30
PID 1648 wrote to memory of 2604	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	30
PID 1648 wrote to memory of 2788	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	31
PID 1648 wrote to memory of 2788	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	31
PID 1648 wrote to memory of 2788	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	31
PID 1648 wrote to memory of 2788	1648	{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe	31
PID 2604 wrote to memory of 2748	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	32
PID 2604 wrote to memory of 2748	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	32
PID 2604 wrote to memory of 2748	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	32
PID 2604 wrote to memory of 2748	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	32
PID 2604 wrote to memory of 2916	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	33
PID 2604 wrote to memory of 2916	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	33
PID 2604 wrote to memory of 2916	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	33
PID 2604 wrote to memory of 2916	2604	{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe	33
PID 2748 wrote to memory of 2892	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	37
PID 2748 wrote to memory of 2892	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	37
PID 2748 wrote to memory of 2892	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	37
PID 2748 wrote to memory of 2892	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	37
PID 2748 wrote to memory of 2032	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	36
PID 2748 wrote to memory of 2032	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	36
PID 2748 wrote to memory of 2032	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	36
PID 2748 wrote to memory of 2032	2748	{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe	36
PID 2892 wrote to memory of 2856	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	38
PID 2892 wrote to memory of 2856	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	38
PID 2892 wrote to memory of 2856	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	38
PID 2892 wrote to memory of 2856	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	38
PID 2892 wrote to memory of 2976	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	39
PID 2892 wrote to memory of 2976	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	39
PID 2892 wrote to memory of 2976	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	39
PID 2892 wrote to memory of 2976	2892	{363EDD10-D92F-4cfe-B069-73FA60301682}.exe	39
PID 2856 wrote to memory of 340	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	40
PID 2856 wrote to memory of 340	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	40
PID 2856 wrote to memory of 340	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	40
PID 2856 wrote to memory of 340	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	40
PID 2856 wrote to memory of 2376	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	41
PID 2856 wrote to memory of 2376	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	41
PID 2856 wrote to memory of 2376	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	41
PID 2856 wrote to memory of 2376	2856	{4A856996-7780-48cd-BEF1-0AD68F964028}.exe	41
PID 340 wrote to memory of 1096	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	42
PID 340 wrote to memory of 1096	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	42
PID 340 wrote to memory of 1096	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	42
PID 340 wrote to memory of 1096	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	42
PID 340 wrote to memory of 1240	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	43
PID 340 wrote to memory of 1240	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	43
PID 340 wrote to memory of 1240	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	43
PID 340 wrote to memory of 1240	340	{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe	43
PID 1096 wrote to memory of 496	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	44
PID 1096 wrote to memory of 496	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	44
PID 1096 wrote to memory of 496	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	44
PID 1096 wrote to memory of 496	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	44
PID 1096 wrote to memory of 1772	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	45
PID 1096 wrote to memory of 1772	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	45
PID 1096 wrote to memory of 1772	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	45
PID 1096 wrote to memory of 1772	1096	{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_ee8677e786d37814a7200bf9e430c69e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
  C:\Windows\{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
    C:\Windows\{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
      C:\Windows\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{11A8A~1.EXE > nul
        5⤵
        
        PID:2032
    - - C:\Windows\{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
        
        C:\Windows\{363EDD10-D92F-4cfe-B069-73FA60301682}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Windows\{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
        
        C:\Windows\{4A856996-7780-48cd-BEF1-0AD68F964028}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
        
        C:\Windows\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:340
        
        C:\Windows\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
        
        C:\Windows\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
        
        C:\Windows\{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:496
        
        C:\Windows\{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
        
        C:\Windows\{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{73906~1.EXE > nul
        11⤵
        
        PID:268
        
        C:\Windows\{0D62699D-D54B-4900-AB28-471E50427F85}.exe
        
        C:\Windows\{0D62699D-D54B-4900-AB28-471E50427F85}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0D626~1.EXE > nul
        12⤵
        
        PID:1664
        
        C:\Windows\{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe
        
        C:\Windows\{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe
        12⤵
        Executes dropped EXE
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{199F2~1.EXE > nul
        10⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{571CD~1.EXE > nul
        9⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C8EF5~1.EXE > nul
        8⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A856~1.EXE > nul
        7⤵
        
        PID:2376
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{363ED~1.EXE > nul
        6⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{22BBA~1.EXE > nul
      4⤵
      PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B310F~1.EXE > nul
    3⤵
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0D62699D-D54B-4900-AB28-471E50427F85}.exe

Filesize
380KB

MD5
ff71b7d8c85ca5b1f10d250a675994fe

SHA1
608488c3d3df333ce92452d535790a5c020defee

SHA256
c94249976ecc4fd8c0418f5d185674bff94b48fd096bf815fc56406c033f97eb

SHA512
a4becb32857d1f975594d71ba4acce2de28dc81113b07545e133f54542f44219e8aeffe6385d0448ba75b00d7f8c792a4a9bc4ebef84021874618041f98d24d4

Download Submit
C:\Windows\{11A8A1EF-E2DE-4d31-ACB3-48F9C9609BD6}.exe

Filesize
380KB

MD5
e8364b81f976f12621f19444abd63489

SHA1
9830effad5aed7e64cfbfcae88ba9a5204a292db

SHA256
fd191b4152a15f500dc98edba4533b5917eacce6db591ce3d6ef52a0b9b3c7e8

SHA512
1d572661e3eb714bda16f457a9a02ab57acddcd2c764ec52764f2c35a4e2d2a288afa1bff8c0419f748d71d56d5147a10fad056216d75586f65f0b6fee95782d

Download Submit
C:\Windows\{199F2F83-BDD6-4014-9DFF-F604A457E096}.exe

Filesize
380KB

MD5
605cda075997d2542487c0df367f57ea

SHA1
2648fdaa7e404fa953db37b1f8cd1da0e08346cc

SHA256
81580a24d4f858a0cd0ae68f790a84e87e7c988659e4b430d24c9d9e12a46331

SHA512
11de754429c79fc6081521af52982a5453956f41c4e6c9e0ec2b1dd175e12298138eec14d4410553c8c0523268fa131438d184ef9a214f8fa31719fedf418eed

Download Submit
C:\Windows\{22BBA863-7BF7-429c-B128-4F7211F047D4}.exe

Filesize
380KB

MD5
3aa5160c4a35464b0f3bd71500b6e72a

SHA1
deef75834236bc6f2076ea825e569ac7cbed804f

SHA256
2652aabcf751620caca80f0a133007776318e1c0297f96ec601a7f290b6393f0

SHA512
4d3ca667cee7167530675a9d4a754a392ac4bbd80ec76d660a453b26247a80fd199aa35aba87f5e46ade605f3f72e6ec5aa00605c2ae0d08461da4c57fdc0671

Download Submit
C:\Windows\{363EDD10-D92F-4cfe-B069-73FA60301682}.exe

Filesize
380KB

MD5
555c96ea448a4f5875d374f4ba6e42df

SHA1
583c0a83e0bebaf652a09542a10ae2ec5b673275

SHA256
dada6a41956f7893fee5e8ea674fce1795e3dbea747818f1b741c673fbddad1c

SHA512
e29b034784322a2c0425f912d3db852ab90d1352c90fcdd55eba73275559a2c5016f22a6e6865a3380b69a7708effe6261a5a6d2bc83c750805a5ee673ebd0ee

Download Submit
C:\Windows\{4A856996-7780-48cd-BEF1-0AD68F964028}.exe

Filesize
380KB

MD5
e510979070abc9fe70d62f2d7a6e25d8

SHA1
a7418ad3f18ec97e732238ba14f443132126c2c2

SHA256
ef886049b9c3dcb2120e207e9fdd0c8281b99059d01eb02f49decb70f1d933f0

SHA512
7933bc13736f2d0ea335fec130e3761a8b845baa434c807618e4e1049594dea337dfdd3ad2a5b974d50457f6221f38b5135d6cb440c49f173eaface4033f7edb

Download Submit
C:\Windows\{571CD5C1-71C7-41b2-A793-8D52FD909DDF}.exe

Filesize
380KB

MD5
4ec6cb57961f893c763756a1a0f20221

SHA1
cd7a4d72a6b3cf9e20794b2eb91fbe87dd3b687c

SHA256
a5c17d3b3af561bf66ee3265398d0f9e1fe8050b34583456109512da59676eea

SHA512
a9ab4393b1c4912a873c0d28b7ad9beaedd773754a8dafe66b1d50012e1fb24b01cf523e38428ec9b2578c5d57b8c77b73f8f101d651cca2ec84faa3d1af17c9

Download Submit
C:\Windows\{591E26C1-089B-4b88-9486-C05DB45E7EA2}.exe

Filesize
380KB

MD5
b110ee77958b2c2875f90d64f65871b9

SHA1
8fabe36553ac4b6f68e62d6503cff48113ff0ee6

SHA256
1c75c921467071cf18db000144167ed991f1fc7265d62ea1f48e55d5312a3429

SHA512
52393636462e9edcfc708482db8d0563c876b3a6111595cbdec89767b35717f44f90f29fd8038c30e100c72e8dea498c584ca8e9d50ae32a620880ac8ac0fda9

Download Submit
C:\Windows\{73906558-53C7-4d92-8D07-DECF7B947CAD}.exe

Filesize
380KB

MD5
1a8e1eb42ebacc14fc58cf32ad03ad64

SHA1
aa2505e95e6c88a4d9710b87bbcd04ed6b15e828

SHA256
493a1a64092a6bb026435c9b8e9151ca0c18aff88f0e3cd7c5a8972bd6aed2bb

SHA512
1ec3a74520aabf7ccc20f295d5225d341174e215eb726446f0d20abddfeed235e713d7b88b55b43369e112b5d79988fafd5a3d9d27a5ab2c6deafaf6bb63ff37

Download Submit
C:\Windows\{B310FD26-44EE-425b-AFB6-198CAEFB295D}.exe

Filesize
380KB

MD5
8f86cb2312686015689d3e62c48a9709

SHA1
62334252542d9d3f0cd40099463080d83688ab4d

SHA256
6317fb54a10352d2d7c0864e9a217bbcd7efc2de4fff7cc9102f425a7ee4e1b3

SHA512
622b6a39e7fd9fe4292a717d74f8fab6c7f8b1152b8b8221cc7a7f87cec1a7c068e12056a97d550c4722a516fe93dca333cec552075f44b800810444fc1521bc

Download Submit
C:\Windows\{C8EF5A5E-A8A4-4623-B789-7762CE61586C}.exe

Filesize
380KB

MD5
f7245539ae7ac212f355d85a8c8df7ed

SHA1
1123d37a87431ee71ffb4a4809d2e08ddef29e81

SHA256
0c3a53efa518f522e0d7001dcc4a882212fc38cc7cf92798a94086a5250926ef

SHA512
106b653ac4e288d1f206fa1c3f46031f0b31f51d1ecb7cff57f1d2e1e75a85637052c5829706a12e93ef8272c69fce04ef2a5ff0c491b1101335380dd5473375

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads