57a7167c5ba4644a67603d4f791f465560b74cbc4c7db85feb38390dcbcc92f5

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Size

408KB
MD5

a69f85d2d1e5658c819e6d7a247626d8
SHA1

7935f6dc087de3ce77d983723b9ffdf512082785
SHA256

57a7167c5ba4644a67603d4f791f465560b74cbc4c7db85feb38390dcbcc92f5
SHA512

f5eb2a152bde4828f435e8e1c4b6956ad738fa3ab25c8fa3efc4df488bd4070466d6dfb08a7c0aa618c15bbb4f18bee1a947c581fa543a77ef598d72a411d3f9
SSDEEP

3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGAldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000900000001227d-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122ff-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f3-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}\stubpath = "C:\\Windows\\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe"	{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}\stubpath = "C:\\Windows\\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe"	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}	{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98CDCF55-D101-40e7-927D-A98B6EC2A871}\stubpath = "C:\\Windows\\{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe"	{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}\stubpath = "C:\\Windows\\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe"	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21DD1345-0A91-43b8-8085-DB74B355820E}\stubpath = "C:\\Windows\\{21DD1345-0A91-43b8-8085-DB74B355820E}.exe"	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}\stubpath = "C:\\Windows\\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe"	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18FC370F-F1DA-427d-9AE9-49451397C517}	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{18FC370F-F1DA-427d-9AE9-49451397C517}\stubpath = "C:\\Windows\\{18FC370F-F1DA-427d-9AE9-49451397C517}.exe"	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90ECD19D-E418-4a47-A862-5BA645D0E457}	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52C20F0E-2931-4afd-A6E2-095D97888CBE}\stubpath = "C:\\Windows\\{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe"	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}	{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98CDCF55-D101-40e7-927D-A98B6EC2A871}	{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}\stubpath = "C:\\Windows\\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe"	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21DD1345-0A91-43b8-8085-DB74B355820E}	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}\stubpath = "C:\\Windows\\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe"	{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{90ECD19D-E418-4a47-A862-5BA645D0E457}\stubpath = "C:\\Windows\\{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe"	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{52C20F0E-2931-4afd-A6E2-095D97888CBE}	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe

Deletes itself 1 IoCs

pid	Process
2612	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
2148	{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
1940	{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
2316	{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
3032	{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
File created	C:\Windows\{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
File created	C:\Windows\{18FC370F-F1DA-427d-9AE9-49451397C517}.exe	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
File created	C:\Windows\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe	{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
File created	C:\Windows\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe	{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
File created	C:\Windows\{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
File created	C:\Windows\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
File created	C:\Windows\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
File created	C:\Windows\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
File created	C:\Windows\{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe	{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
File created	C:\Windows\{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
Token: SeIncBasePriorityPrivilege	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
Token: SeIncBasePriorityPrivilege	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
Token: SeIncBasePriorityPrivilege	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
Token: SeIncBasePriorityPrivilege	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
Token: SeIncBasePriorityPrivilege	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
Token: SeIncBasePriorityPrivilege	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
Token: SeIncBasePriorityPrivilege	2148	{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
Token: SeIncBasePriorityPrivilege	1940	{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
Token: SeIncBasePriorityPrivilege	2316	{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2948	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	28
PID 3044 wrote to memory of 2948	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	28
PID 3044 wrote to memory of 2948	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	28
PID 3044 wrote to memory of 2948	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	28
PID 3044 wrote to memory of 2612	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	29
PID 3044 wrote to memory of 2612	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	29
PID 3044 wrote to memory of 2612	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	29
PID 3044 wrote to memory of 2612	3044	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	29
PID 2948 wrote to memory of 2688	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	31
PID 2948 wrote to memory of 2688	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	31
PID 2948 wrote to memory of 2688	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	31
PID 2948 wrote to memory of 2688	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	31
PID 2948 wrote to memory of 2684	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	30
PID 2948 wrote to memory of 2684	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	30
PID 2948 wrote to memory of 2684	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	30
PID 2948 wrote to memory of 2684	2948	{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe	30
PID 2688 wrote to memory of 2524	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	35
PID 2688 wrote to memory of 2524	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	35
PID 2688 wrote to memory of 2524	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	35
PID 2688 wrote to memory of 2524	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	35
PID 2688 wrote to memory of 2448	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	34
PID 2688 wrote to memory of 2448	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	34
PID 2688 wrote to memory of 2448	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	34
PID 2688 wrote to memory of 2448	2688	{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe	34
PID 2524 wrote to memory of 528	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	36
PID 2524 wrote to memory of 528	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	36
PID 2524 wrote to memory of 528	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	36
PID 2524 wrote to memory of 528	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	36
PID 2524 wrote to memory of 1112	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	37
PID 2524 wrote to memory of 1112	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	37
PID 2524 wrote to memory of 1112	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	37
PID 2524 wrote to memory of 1112	2524	{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe	37
PID 528 wrote to memory of 2712	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	38
PID 528 wrote to memory of 2712	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	38
PID 528 wrote to memory of 2712	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	38
PID 528 wrote to memory of 2712	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	38
PID 528 wrote to memory of 2728	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	39
PID 528 wrote to memory of 2728	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	39
PID 528 wrote to memory of 2728	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	39
PID 528 wrote to memory of 2728	528	{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe	39
PID 2712 wrote to memory of 3064	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	41
PID 2712 wrote to memory of 3064	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	41
PID 2712 wrote to memory of 3064	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	41
PID 2712 wrote to memory of 3064	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	41
PID 2712 wrote to memory of 1272	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	40
PID 2712 wrote to memory of 1272	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	40
PID 2712 wrote to memory of 1272	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	40
PID 2712 wrote to memory of 1272	2712	{21DD1345-0A91-43b8-8085-DB74B355820E}.exe	40
PID 3064 wrote to memory of 2168	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	43
PID 3064 wrote to memory of 2168	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	43
PID 3064 wrote to memory of 2168	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	43
PID 3064 wrote to memory of 2168	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	43
PID 3064 wrote to memory of 1248	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	42
PID 3064 wrote to memory of 1248	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	42
PID 3064 wrote to memory of 1248	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	42
PID 3064 wrote to memory of 1248	3064	{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe	42
PID 2168 wrote to memory of 2148	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	45
PID 2168 wrote to memory of 2148	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	45
PID 2168 wrote to memory of 2148	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	45
PID 2168 wrote to memory of 2148	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	45
PID 2168 wrote to memory of 2640	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	44
PID 2168 wrote to memory of 2640	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	44
PID 2168 wrote to memory of 2640	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	44
PID 2168 wrote to memory of 2640	2168	{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
  C:\Windows\{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{90ECD~1.EXE > nul
    3⤵
    PID:2684
- - C:\Windows\{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
    C:\Windows\{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{52C20~1.EXE > nul
      4⤵
      PID:2448
  - - C:\Windows\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
      C:\Windows\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Windows\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
        
        C:\Windows\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
      - C:\Windows\{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
        
        C:\Windows\{21DD1345-0A91-43b8-8085-DB74B355820E}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21DD1~1.EXE > nul
        7⤵
        
        PID:1272
        
        C:\Windows\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
        
        C:\Windows\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9F37~1.EXE > nul
        8⤵
        
        PID:1248
        
        C:\Windows\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
        
        C:\Windows\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2E81F~1.EXE > nul
        9⤵
        
        PID:2640
        
        C:\Windows\{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
        
        C:\Windows\{18FC370F-F1DA-427d-9AE9-49451397C517}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18FC3~1.EXE > nul
        10⤵
        
        PID:1976
        
        C:\Windows\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
        
        C:\Windows\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D882~1.EXE > nul
        11⤵
        
        PID:3012
        
        C:\Windows\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
        
        C:\Windows\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21565~1.EXE > nul
        12⤵
        
        PID:2100
        
        C:\Windows\{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe
        
        C:\Windows\{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe
        12⤵
        Executes dropped EXE
        
        PID:3032
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6EE9~1.EXE > nul
        6⤵
        
        PID:2728
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF0E5~1.EXE > nul
        5⤵
        
        PID:1112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{18FC370F-F1DA-427d-9AE9-49451397C517}.exe

Filesize
408KB

MD5
22dd79552b1d1a2189e734d8032fd534

SHA1
4c282383e4f6da06ad24776f2fd47f2679842046

SHA256
a3923cc3829a5853804eec3496f27dd9798cf59754fb2f1951e95353b13ae90c

SHA512
6c7251c0f9213b23ff89d9196efb11fb3a7e1c01319b571e91b927174dbce759ba28d2905c2b96ea539e7f261de65a2972f0d78f6e246339ecff32af58d9c0d3

Download Submit
C:\Windows\{2156554D-18C2-46b3-8E68-ADE824D1ACAF}.exe

Filesize
408KB

MD5
43310afa8ee502d05f39ef51aae3680b

SHA1
68acf45085c9bc98593d9805154ee0d8bc17ce2b

SHA256
7e2deced882d297bf9c89169f1bbfb972ffa02e5b32a0c33b3ac4b1e4e357bb9

SHA512
78a526b23bd1f6ca6cd2c0cc3dbf3f51a768b11bda86503271a6287c824bdf4e163989c8a5316c4a40032fad18fcee26176cdf41da4c67cbb13fce48c7c8e5d5

Download Submit
C:\Windows\{21DD1345-0A91-43b8-8085-DB74B355820E}.exe

Filesize
408KB

MD5
233397a8fc94be57cb7ac54ef87c8b75

SHA1
55f722c897dc7b670b0ebdc9b00efbf40371188f

SHA256
9cec6fe8c3719344794d3ee85141468b1e1cec58fed3973b50fd5774436a4b9c

SHA512
5d20f19e6310ffe5326bf4bcee3a513c006966d23431b86576a9462bf5384514a1679d1012bb4eecbb84153984bfada65a7c2908093369fa2d40d41b929c41e2

Download Submit
C:\Windows\{2E81FC8D-4C95-40f7-A412-92A1A6DEE749}.exe

Filesize
408KB

MD5
9ffd502480502846bef88503ccea78db

SHA1
d77025e9945781d597a0d23a2a422bcb50db4498

SHA256
33e544d5ac13d1649245662fb48fce803dc936df9ecb63527a2e3bd22262cf7f

SHA512
f7641882c638a8f169ef0388d0bfe4d7806e0c21f4292cc607cf9280260345c0d228d1bfe76e67f8ce9dfd0ac67d96f377b3480297c74bf51e791f3f8bb1625c

Download Submit
C:\Windows\{52C20F0E-2931-4afd-A6E2-095D97888CBE}.exe

Filesize
408KB

MD5
ba1c9c2c199021930cb99f81ad50ebb2

SHA1
d82466ae1db0d464f668a3d52fd115d243b7dec8

SHA256
cfe3fad8641ee010b3eb38d688f3894e73ef059bcef17ef42b2f1672925b4d89

SHA512
be347ec73bf696efcf4ebb786e1d6c693981025c8d133d75ba11ee10190f0380ddffd97dd6bd1de097a50d8434279ac4cd485377b4859f05bbb3eaf47c48b8c6

Download Submit
C:\Windows\{5D8827B5-DE1C-4e28-8BE0-C70127678A05}.exe

Filesize
408KB

MD5
fc855447edb00185229ae3130f50c546

SHA1
5bc50681dc56cc093270aa75ac83b861a1056874

SHA256
0e77d08c34a325a97ae0be3a9e034d7f1d2c2502fbf297bca6aaeafcd985e9b2

SHA512
31c4136aee5397da706a8b52a63ae599a92a78d374d054d9183886c8eb215c55a518b0c037aca8bfbb42677b6e8875dd0dc77fdb752700936bf3af2c3840039c

Download Submit
C:\Windows\{90ECD19D-E418-4a47-A862-5BA645D0E457}.exe

Filesize
408KB

MD5
db8df0e7c3ea776a37e1b3e7a5731c64

SHA1
7fc4e4dc8e0da9f18fdd3ae26f9974c94e7d3398

SHA256
649771a96df4f2df720e5675d63e1a4cbc05abab4afc133cc78e0b2fae523917

SHA512
9bc0608dc45035fc7b4ceb4082c33fe1d8bf1de6ee47a62c92ad1633c0e364e716ae66ead5d7b4d48a394147fcbfbd100de93a3f1e4836d6cdf60eb4845b8e6f

Download Submit
C:\Windows\{98CDCF55-D101-40e7-927D-A98B6EC2A871}.exe

Filesize
408KB

MD5
0253a6faae773c48b7cf22888ea4f7f3

SHA1
2286b470cf3161fd39d0abb83d83490b64443750

SHA256
606f73fb275f2068d9a9aa0ddc7b46c149a39009957adffea463ee2158694498

SHA512
e287032ad1644a7c98f2e0d6afe19a10d189ef16385017e439e6fb46b6db06dfeae4899e97883f4d71000a5796c91c9e7a45944d1474c116fcf2b8070f72008e

Download Submit
C:\Windows\{C9F37310-0BE6-47fd-8BFC-692677B18C8E}.exe

Filesize
408KB

MD5
33a46d1d05f5258f4e91155d6cbd74ce

SHA1
b6fdd7b04dd47502f1be4ca41526e7861152a2ee

SHA256
408d6d8128f76cee881ee72510ebcf79288eecaa3daac03ad8efea6f80d131d1

SHA512
8f5aad3087b9d3a17c5961e2cbcd04e6be3160525a7fae5e6ff9854fc86e3db7ecc29099a48169b5c6498e85ea3a73298e1ac23ef57582532b321ad562711e04

Download Submit
C:\Windows\{D6EE9790-CFD7-4077-99D8-E7C42CBED99C}.exe

Filesize
408KB

MD5
cb4f75dddcf34f9c61316eddea8adf54

SHA1
26c8b063e71e7f181fe302faf40fade4b9f5354e

SHA256
09f7608e0ea79d598426a9252dbeb0246db7e2fccca622ebeb7650e24f6eb03f

SHA512
96d42028a6a3c15938b5edb4c71427cca44bdc6144926201b292bb7595b57601b383498c5843b3368b5a2234d77073727b58e756c26df5cd944467bef105b6cf

Download Submit
C:\Windows\{FF0E5313-905D-43c0-AFA0-EC5C3CE87A9D}.exe

Filesize
408KB

MD5
23adb745cc4f3b0fb95437658081dee7

SHA1
e20172108cb88eff8bbff7f7b38c46802ddd3a48

SHA256
6f4b4c4c6f3ef8678a1844b619b6b25b4ccddaf9c42bdbb25e8810b5dd8e7dfa

SHA512
973f8ae0ec017ab1c5d8e252daa2a19a9970aed29b96b12958bcc2dfebcbd70136547e52bfbfd5f2c7ad528485b50c67b85f0476d18f005bfe6998e746457a6f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads