44b8540ceec9492663ea8fbb0dbf060d18a7826d91a65f7d5aebbca0370b513f

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
Size

408KB
MD5

f877d2de6adb863edd5ed734091acab7
SHA1

44ad71b856ef71f7a36ac5c9f34e84bd4e7d7532
SHA256

44b8540ceec9492663ea8fbb0dbf060d18a7826d91a65f7d5aebbca0370b513f
SHA512

6d9a185689857731c240b325842f359989236322d2203ccc8263f3f3ceee026db95e48982a4c200090d3c9345c1f5c6cb8c427b35f62f44d7875327a893a2219
SSDEEP

3072:CEGh0oql3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGUldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023213-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023213-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023214-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002321c-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e759-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002321c-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000001e759-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002321c-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000500000001e759-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002321c-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e759-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023218-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8918717-8134-49dc-873A-197FC334FCEB}\stubpath = "C:\\Windows\\{C8918717-8134-49dc-873A-197FC334FCEB}.exe"	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}\stubpath = "C:\\Windows\\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe"	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DEB39A1-1F4E-41cc-80C2-0AF0B2A56DE0}	{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC170669-297A-4071-89C6-02F1DEC9C0D4}	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}\stubpath = "C:\\Windows\\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe"	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC170669-297A-4071-89C6-02F1DEC9C0D4}\stubpath = "C:\\Windows\\{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe"	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8314B5D6-7C33-492b-BBF6-294F5C746C54}	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A194A522-B037-4b60-988C-3764E21437D0}	{C8918717-8134-49dc-873A-197FC334FCEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A194A522-B037-4b60-988C-3764E21437D0}\stubpath = "C:\\Windows\\{A194A522-B037-4b60-988C-3764E21437D0}.exe"	{C8918717-8134-49dc-873A-197FC334FCEB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95964543-DB83-4e40-8FB8-D489DECBB5DD}	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}\stubpath = "C:\\Windows\\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe"	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{356895B7-DCE2-45c0-9F5C-724007DD584C}\stubpath = "C:\\Windows\\{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe"	{A194A522-B037-4b60-988C-3764E21437D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}\stubpath = "C:\\Windows\\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe"	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}\stubpath = "C:\\Windows\\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe"	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8918717-8134-49dc-873A-197FC334FCEB}	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{356895B7-DCE2-45c0-9F5C-724007DD584C}	{A194A522-B037-4b60-988C-3764E21437D0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95964543-DB83-4e40-8FB8-D489DECBB5DD}\stubpath = "C:\\Windows\\{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe"	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DEB39A1-1F4E-41cc-80C2-0AF0B2A56DE0}\stubpath = "C:\\Windows\\{0DEB39A1-1F4E-41cc-80C2-0AF0B2A56DE0}.exe"	{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8314B5D6-7C33-492b-BBF6-294F5C746C54}\stubpath = "C:\\Windows\\{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe"	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe

Executes dropped EXE 11 IoCs

pid	Process
2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe
4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe
4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
564	{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
File created	C:\Windows\{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
File created	C:\Windows\{A194A522-B037-4b60-988C-3764E21437D0}.exe	{C8918717-8134-49dc-873A-197FC334FCEB}.exe
File created	C:\Windows\{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
File created	C:\Windows\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
File created	C:\Windows\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
File created	C:\Windows\{0DEB39A1-1F4E-41cc-80C2-0AF0B2A56DE0}.exe	{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe
File created	C:\Windows\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
File created	C:\Windows\{C8918717-8134-49dc-873A-197FC334FCEB}.exe	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
File created	C:\Windows\{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	{A194A522-B037-4b60-988C-3764E21437D0}.exe
File created	C:\Windows\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
File created	C:\Windows\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
Token: SeIncBasePriorityPrivilege	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
Token: SeIncBasePriorityPrivilege	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
Token: SeIncBasePriorityPrivilege	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe
Token: SeIncBasePriorityPrivilege	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe
Token: SeIncBasePriorityPrivilege	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
Token: SeIncBasePriorityPrivilege	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
Token: SeIncBasePriorityPrivilege	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
Token: SeIncBasePriorityPrivilege	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
Token: SeIncBasePriorityPrivilege	1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2244	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	94
PID 2672 wrote to memory of 2244	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	94
PID 2672 wrote to memory of 2244	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	94
PID 2672 wrote to memory of 1784	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	95
PID 2672 wrote to memory of 1784	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	95
PID 2672 wrote to memory of 1784	2672	2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe	95
PID 2244 wrote to memory of 1328	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	96
PID 2244 wrote to memory of 1328	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	96
PID 2244 wrote to memory of 1328	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	96
PID 2244 wrote to memory of 552	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	97
PID 2244 wrote to memory of 552	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	97
PID 2244 wrote to memory of 552	2244	{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe	97
PID 1328 wrote to memory of 1320	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	101
PID 1328 wrote to memory of 1320	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	101
PID 1328 wrote to memory of 1320	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	101
PID 1328 wrote to memory of 3140	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	100
PID 1328 wrote to memory of 3140	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	100
PID 1328 wrote to memory of 3140	1328	{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe	100
PID 1320 wrote to memory of 1164	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	104
PID 1320 wrote to memory of 1164	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	104
PID 1320 wrote to memory of 1164	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	104
PID 1320 wrote to memory of 2288	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	105
PID 1320 wrote to memory of 2288	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	105
PID 1320 wrote to memory of 2288	1320	{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe	105
PID 1164 wrote to memory of 4092	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	106
PID 1164 wrote to memory of 4092	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	106
PID 1164 wrote to memory of 4092	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	106
PID 1164 wrote to memory of 4284	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	107
PID 1164 wrote to memory of 4284	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	107
PID 1164 wrote to memory of 4284	1164	{C8918717-8134-49dc-873A-197FC334FCEB}.exe	107
PID 4092 wrote to memory of 4336	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	108
PID 4092 wrote to memory of 4336	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	108
PID 4092 wrote to memory of 4336	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	108
PID 4092 wrote to memory of 2892	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	109
PID 4092 wrote to memory of 2892	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	109
PID 4092 wrote to memory of 2892	4092	{A194A522-B037-4b60-988C-3764E21437D0}.exe	109
PID 4336 wrote to memory of 2072	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	110
PID 4336 wrote to memory of 2072	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	110
PID 4336 wrote to memory of 2072	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	110
PID 4336 wrote to memory of 2872	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	111
PID 4336 wrote to memory of 2872	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	111
PID 4336 wrote to memory of 2872	4336	{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe	111
PID 2072 wrote to memory of 736	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	112
PID 2072 wrote to memory of 736	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	112
PID 2072 wrote to memory of 736	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	112
PID 2072 wrote to memory of 812	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	113
PID 2072 wrote to memory of 812	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	113
PID 2072 wrote to memory of 812	2072	{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe	113
PID 736 wrote to memory of 1204	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	114
PID 736 wrote to memory of 1204	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	114
PID 736 wrote to memory of 1204	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	114
PID 736 wrote to memory of 3832	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	115
PID 736 wrote to memory of 3832	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	115
PID 736 wrote to memory of 3832	736	{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe	115
PID 1204 wrote to memory of 1548	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	116
PID 1204 wrote to memory of 1548	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	116
PID 1204 wrote to memory of 1548	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	116
PID 1204 wrote to memory of 3468	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	117
PID 1204 wrote to memory of 3468	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	117
PID 1204 wrote to memory of 3468	1204	{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe	117
PID 1548 wrote to memory of 564	1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe	118
PID 1548 wrote to memory of 564	1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe	118
PID 1548 wrote to memory of 564	1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe	118
PID 1548 wrote to memory of 2140	1548	{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f877d2de6adb863edd5ed734091acab7_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
  C:\Windows\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
    C:\Windows\{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DC170~1.EXE > nul
      4⤵
      PID:3140
  - - C:\Windows\{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
      C:\Windows\{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\{C8918717-8134-49dc-873A-197FC334FCEB}.exe
        
        C:\Windows\{C8918717-8134-49dc-873A-197FC334FCEB}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\{A194A522-B037-4b60-988C-3764E21437D0}.exe
        
        C:\Windows\{A194A522-B037-4b60-988C-3764E21437D0}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
        
        C:\Windows\{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
        
        C:\Windows\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
        
        C:\Windows\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
        
        C:\Windows\{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
        
        C:\Windows\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe
        
        C:\Windows\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2881B~1.EXE > nul
        12⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95964~1.EXE > nul
        11⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EDB48~1.EXE > nul
        10⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{405FB~1.EXE > nul
        9⤵
        
        PID:812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{35689~1.EXE > nul
        8⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A194A~1.EXE > nul
        7⤵
        
        PID:2892
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C8918~1.EXE > nul
        6⤵
        
        PID:4284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8314B~1.EXE > nul
        5⤵
        
        PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0B567~1.EXE > nul
    3⤵
    PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe

Filesize
128KB

MD5
e41520f52c7ead2b888db63d08087894

SHA1
88bccc8374985ce83f5f252b7851bff1ff5eaf46

SHA256
8c1095c8dd9c221bddc01a7b50efe6a6c21e8eb2b5e7ac8ae4da2c49dc4a19aa

SHA512
80d84bac62772ff5f8e38af48e642a56435d87a3fccbb82a05106751621f0e29397c686896fc85a1f458a2825cd1510c8fe719849dfc687fe6477f303d54f3ec

Download Submit
C:\Windows\{0B567199-1B3D-4de5-B5A8-9ABA38337C6A}.exe

Filesize
408KB

MD5
eee552510981bdad8edbbbb18948fbd2

SHA1
4b9f34317560b4c3765a42d0ca902e87233509a7

SHA256
966f78f5223226d2b73153cf0934c8e9ebe6fe0fa82061a1f3ebee03af4511df

SHA512
da8363ce563e33086901aeaf211d015aa5d1f89af825e272ff51bf67bc5ccacf2d6f68f57767dddc87d3e8722c03fcb6236ddbc028fa6ab14de125ceacfed8a2

Download Submit
C:\Windows\{2881B51E-4F6C-4f98-B8E8-96CCF67ED476}.exe

Filesize
408KB

MD5
ed95491ca6aa80d48c6590b38202f428

SHA1
4b8af47c5c7331669b896f19d9ed7b3de2e82241

SHA256
a75c0c5dfdce307f8eec16d7c1c239f4a2265cf323473db50ae4776bdb4426d9

SHA512
21831f5510fcbc2e759068236eced845004e3ad24105a18dd77e9e5d9a82b4faa77e512e5d2a8934819c2a04664c96cdc6f3dadbec2ed0c0460894bd6cf5e6b8

Download Submit
C:\Windows\{356895B7-DCE2-45c0-9F5C-724007DD584C}.exe

Filesize
408KB

MD5
8aba97de4f79a5b9ffb3082e4469b957

SHA1
1dd6cca6d5ead495d7a395d7fec5eaec432d4629

SHA256
7cd3de1420ee841518b87a4aba463758af18a7b50d579fdba3ac4aedf7d0076a

SHA512
bc7addcea87895c90c6a694fc6982746ae559a466b2872d3dda086f1c22133fedc3947f024e700061943e19e05afbd1fa9a97e767b75816128850f459725945c

Download Submit
C:\Windows\{405FB7E8-10B0-4cc3-ACA0-7468DC3F4A30}.exe

Filesize
408KB

MD5
b39015eb2da8be7f62466efaf4053f45

SHA1
1f3566cb9b31c906120a6100f46789280cbdcb50

SHA256
a2b2255718cd337c51bb9c1316b78ce749e8ddefe0e65c3ce4ea90cb10cfe162

SHA512
e561a54601669fc89cd1a70a80b55505507d7afb27e1f1908c1a7a1efed3d0e10270d259c54c11295387abbb44b66591e0f93ffe90678b9323792063b6678001

Download Submit
C:\Windows\{8314B5D6-7C33-492b-BBF6-294F5C746C54}.exe

Filesize
408KB

MD5
aa67a79e1e84520db884e2265a89f27f

SHA1
2c7868499e15331036525adc935309b51e5b37db

SHA256
6d859f002dd385752e196d928bd0542da06db0b96f06e2698fd885c47fd02cd1

SHA512
fae5c709fb4e67ca5014ed2b85c9b04ee4d96b4775080376b1483854cf431a1f82b8436d0517e371c4421e8ae57d9f2c09493e6532cea90907d57a6c711ca48f

Download Submit
C:\Windows\{95964543-DB83-4e40-8FB8-D489DECBB5DD}.exe

Filesize
408KB

MD5
0d6c53371833964962cb97f3e2392fe0

SHA1
5559739f422be35419accfa91e9208638205c603

SHA256
8d46beb4a47af3ab2796eb45c058ea7dd2a67a2197c5261578db2a59183cc3e7

SHA512
7b6d2ada26dc1d726931b8157e5ed9b0324f94abc17407a4a8a674ed679e765540a05ced0f7120db0d2b96c5e8560cb11619ebe4c28fee78b72f0904d1fec2b2

Download Submit
C:\Windows\{A194A522-B037-4b60-988C-3764E21437D0}.exe

Filesize
408KB

MD5
e18e129f4304ffa354608f12b7823fc3

SHA1
87313d55c35a129e29e4e804b895b6dec4dcce36

SHA256
2fcea947b3b428916b682ce427112df832483aa4bf4f638769efbb8835c123b1

SHA512
42de8a1e6978f3b8e1e15fc9f957bf543d4c03f98a55f4717cf2968c12dee0585f7b35884c6b249062643a434997b1f41ee91a4bb5de85156e4c53175469c71d

Download Submit
C:\Windows\{C8918717-8134-49dc-873A-197FC334FCEB}.exe

Filesize
408KB

MD5
d8332b318802aba5ade6fdf4e4ea1951

SHA1
14f5288003f23091b0cac0bb7857e34170486014

SHA256
58e261fab7c303b1db2c291ae544e996d94f7079f5d229916e37455ef4b9119a

SHA512
c590ddc9b7b3dbd6b05b1eafe6ba3e82f35c862baa3a401b37ad0080f709198936e85a76cbdb0a2efe5cfcf051d7c1b9f9a1fa67884d9fbfa032b14019e55daf

Download Submit
C:\Windows\{DC170669-297A-4071-89C6-02F1DEC9C0D4}.exe

Filesize
408KB

MD5
1e7574a98303824f17141a0e3d0d6c10

SHA1
9877a3c26ba844b6fa24d154b1bcd6eda7102afd

SHA256
427513abd25cbbe554a7688bf332e28cc147eb03d218e355d6fcf59919bfb0fd

SHA512
d48b138b869ed984f4c369b8c7712c997559d5df3356c336d0b4445b3f8f430e719e77b3464640bc8f477e0708be85033c63ce1f7aad5cc41464773917be06ee

Download Submit
C:\Windows\{EDB484B5-E73B-46c1-9955-4C7E4E9EEF85}.exe

Filesize
408KB

MD5
af8592f349741f0a2dcc83ee2cb5da37

SHA1
a9bd590655ec8e4a2bc01b17bed03dd7eb4acd5d

SHA256
06501eb53b3c2975d412767d084467900036eadfa79d1c63502a58b0abe8ba19

SHA512
00296cca8e0325272357488783b2dd938d61eacce83d4430c9726b0fd9444974d8deab6c5ec8515548b5c15183b9fb68b099307461d186e3b36f8d6f9c950f2b

Download Submit
C:\Windows\{FDCD9039-37CC-449c-8D28-68EA5F12A39E}.exe

Filesize
408KB

MD5
089138788f28650fb2f3ce1dffe0c9ad

SHA1
59a2ebec483b35dc547bb7a5df64872fd63788c3

SHA256
4e8f4a08a3a6e04c06884d169b48c09356d9a7ead491a7307454311e1d26f16e

SHA512
caa85a15440ab7ac1b454b643422133cd6d8ded4b38134b569db70fd4a7bc1b5f1cef40670640afd0093e46722b666670d79519a96a5d788d5c9960e73867933

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads