ccbf923a42fbdb4dbf7983a27400aee65187e83f5ed28b3f59ed216b7e868379

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
Size 344KB
Sample240302-q2m88adh8t
SHA256 ccbf923a42fbdb4dbf7983a27400aee65187e83f5ed28b3f59ed216b7e868379
MD5 b1a200f5630273a61bf7ef7aa5d83eec
SHA1 458cb1f58e0e2b663230bdeb14840b36f4ec4774
SHA512 de288f8774dbfcbb1504f8cd9e4782b81244a01365d390721c056ea21d3694dad2531c201a7f94aad25aa5cf542e1216d0ed34911d1e698a3d6e9220de6d4e3e
SSDEEP 3072:mEGh0o8lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGWlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0005000000022ea1-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000001e457-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023274-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002312c-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023274-17.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002312c-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023274-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a00000002312c-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b000000023274-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b00000002312c-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002326e-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c00000002312c-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{817474AD-5BC8-41bb-9E17-83239F5560FB}\stubpath = "C:\\Windows\\{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe"	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}\stubpath = "C:\\Windows\\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe"	{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}\stubpath = "C:\\Windows\\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe"	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2DFB62C-C452-412e-8C5B-D634379D090A}	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{817474AD-5BC8-41bb-9E17-83239F5560FB}	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31615E6B-E0FA-47fc-8596-784FEE597650}\stubpath = "C:\\Windows\\{31615E6B-E0FA-47fc-8596-784FEE597650}.exe"	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA641180-53F7-4dae-8225-211066583A32}	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}\stubpath = "C:\\Windows\\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe"	{AA641180-53F7-4dae-8225-211066583A32}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6951782D-3638-45fd-A7D0-AC92C4996330}\stubpath = "C:\\Windows\\{6951782D-3638-45fd-A7D0-AC92C4996330}.exe"	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56857A33-FEE2-48f6-9692-DBBD34B81622}\stubpath = "C:\\Windows\\{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe"	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}\stubpath = "C:\\Windows\\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe"	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD76A468-1329-403c-A4FD-4798421DD197}	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}	{FD76A468-1329-403c-A4FD-4798421DD197}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}\stubpath = "C:\\Windows\\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe"	{FD76A468-1329-403c-A4FD-4798421DD197}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA641180-53F7-4dae-8225-211066583A32}\stubpath = "C:\\Windows\\{AA641180-53F7-4dae-8225-211066583A32}.exe"	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}	{AA641180-53F7-4dae-8225-211066583A32}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31615E6B-E0FA-47fc-8596-784FEE597650}	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}	{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56857A33-FEE2-48f6-9692-DBBD34B81622}	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD76A468-1329-403c-A4FD-4798421DD197}\stubpath = "C:\\Windows\\{FD76A468-1329-403c-A4FD-4798421DD197}.exe"	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2DFB62C-C452-412e-8C5B-D634379D090A}\stubpath = "C:\\Windows\\{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe"	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6951782D-3638-45fd-A7D0-AC92C4996330}	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe

Executes dropped EXE 12 IoCs

pid	Process
1532	{AA641180-53F7-4dae-8225-211066583A32}.exe
4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe
720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
3456	{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
4732	{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
File created	C:\Windows\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
File created	C:\Windows\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	{FD76A468-1329-403c-A4FD-4798421DD197}.exe
File created	C:\Windows\{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
File created	C:\Windows\{31615E6B-E0FA-47fc-8596-784FEE597650}.exe	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
File created	C:\Windows\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe	{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
File created	C:\Windows\{AA641180-53F7-4dae-8225-211066583A32}.exe	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
File created	C:\Windows\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	{AA641180-53F7-4dae-8225-211066583A32}.exe
File created	C:\Windows\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
File created	C:\Windows\{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
File created	C:\Windows\{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
File created	C:\Windows\{FD76A468-1329-403c-A4FD-4798421DD197}.exe	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe
Token: SeIncBasePriorityPrivilege	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
Token: SeIncBasePriorityPrivilege	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
Token: SeIncBasePriorityPrivilege	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
Token: SeIncBasePriorityPrivilege	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
Token: SeIncBasePriorityPrivilege	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
Token: SeIncBasePriorityPrivilege	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
Token: SeIncBasePriorityPrivilege	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe
Token: SeIncBasePriorityPrivilege	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
Token: SeIncBasePriorityPrivilege	2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
Token: SeIncBasePriorityPrivilege	3456	{31615E6B-E0FA-47fc-8596-784FEE597650}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1532	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	98
PID 376 wrote to memory of 1532	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	98
PID 376 wrote to memory of 1532	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	98
PID 376 wrote to memory of 3664	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	99
PID 376 wrote to memory of 3664	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	99
PID 376 wrote to memory of 3664	376	2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe	99
PID 1532 wrote to memory of 4440	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	100
PID 1532 wrote to memory of 4440	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	100
PID 1532 wrote to memory of 4440	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	100
PID 1532 wrote to memory of 3348	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	101
PID 1532 wrote to memory of 3348	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	101
PID 1532 wrote to memory of 3348	1532	{AA641180-53F7-4dae-8225-211066583A32}.exe	101
PID 4440 wrote to memory of 4340	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	104
PID 4440 wrote to memory of 4340	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	104
PID 4440 wrote to memory of 4340	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	104
PID 4440 wrote to memory of 2756	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	105
PID 4440 wrote to memory of 2756	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	105
PID 4440 wrote to memory of 2756	4440	{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe	105
PID 4340 wrote to memory of 4148	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	108
PID 4340 wrote to memory of 4148	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	108
PID 4340 wrote to memory of 4148	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	108
PID 4340 wrote to memory of 3656	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	109
PID 4340 wrote to memory of 3656	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	109
PID 4340 wrote to memory of 3656	4340	{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe	109
PID 4148 wrote to memory of 4128	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	110
PID 4148 wrote to memory of 4128	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	110
PID 4148 wrote to memory of 4128	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	110
PID 4148 wrote to memory of 3828	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	111
PID 4148 wrote to memory of 3828	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	111
PID 4148 wrote to memory of 3828	4148	{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe	111
PID 4128 wrote to memory of 4336	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	112
PID 4128 wrote to memory of 4336	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	112
PID 4128 wrote to memory of 4336	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	112
PID 4128 wrote to memory of 4156	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	113
PID 4128 wrote to memory of 4156	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	113
PID 4128 wrote to memory of 4156	4128	{6951782D-3638-45fd-A7D0-AC92C4996330}.exe	113
PID 4336 wrote to memory of 4580	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	114
PID 4336 wrote to memory of 4580	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	114
PID 4336 wrote to memory of 4580	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	114
PID 4336 wrote to memory of 3588	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	115
PID 4336 wrote to memory of 3588	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	115
PID 4336 wrote to memory of 3588	4336	{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe	115
PID 4580 wrote to memory of 2612	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	116
PID 4580 wrote to memory of 2612	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	116
PID 4580 wrote to memory of 2612	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	116
PID 4580 wrote to memory of 4764	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	117
PID 4580 wrote to memory of 4764	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	117
PID 4580 wrote to memory of 4764	4580	{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe	117
PID 2612 wrote to memory of 720	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	118
PID 2612 wrote to memory of 720	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	118
PID 2612 wrote to memory of 720	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	118
PID 2612 wrote to memory of 3644	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	119
PID 2612 wrote to memory of 3644	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	119
PID 2612 wrote to memory of 3644	2612	{FD76A468-1329-403c-A4FD-4798421DD197}.exe	119
PID 720 wrote to memory of 2204	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	120
PID 720 wrote to memory of 2204	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	120
PID 720 wrote to memory of 2204	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	120
PID 720 wrote to memory of 844	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	121
PID 720 wrote to memory of 844	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	121
PID 720 wrote to memory of 844	720	{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe	121
PID 2204 wrote to memory of 3456	2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe	122
PID 2204 wrote to memory of 3456	2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe	122
PID 2204 wrote to memory of 3456	2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe	122
PID 2204 wrote to memory of 2772	2204	{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe	123

C:\Users\Admin\AppData\Local\Temp\2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-02_b1a200f5630273a61bf7ef7aa5d83eec_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\{AA641180-53F7-4dae-8225-211066583A32}.exe
  C:\Windows\{AA641180-53F7-4dae-8225-211066583A32}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
    C:\Windows\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
      C:\Windows\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
        
        C:\Windows\{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4148
      - C:\Windows\{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
        
        C:\Windows\{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
        
        C:\Windows\{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
        
        C:\Windows\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\{FD76A468-1329-403c-A4FD-4798421DD197}.exe
        
        C:\Windows\{FD76A468-1329-403c-A4FD-4798421DD197}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
        
        C:\Windows\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
        
        C:\Windows\{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
        
        C:\Windows\{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
        
        C:\Windows\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe
        
        C:\Windows\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe
        13⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31615~1.EXE > nul
        13⤵
        
        PID:456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81747~1.EXE > nul
        12⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A59AC~1.EXE > nul
        11⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD76A~1.EXE > nul
        10⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FABBB~1.EXE > nul
        9⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56857~1.EXE > nul
        8⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69517~1.EXE > nul
        7⤵
        
        PID:4156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D2DFB~1.EXE > nul
        6⤵
        
        PID:3828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A569~1.EXE > nul
        5⤵
        
        PID:3656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{01A13~1.EXE > nul
      4⤵
      PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AA641~1.EXE > nul
    3⤵
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe

Path C:\Windows\{01A13354-7CA1-4b9f-B63D-58693B65FB7B}.exe
Size 344KB
SHA256 4ef13b04aea85421e61b2fd27517b8a86eefd33eacadf5d6e6d702e94fc42ada
MD5 cad8864e059f03e8cd9475c2f4e6e4dc
SHA1 58efae12a44c0a379e5d4221500d881ece19079f
SHA512 a92d3870e50e609fbf11dfe1e18895255fd4426c3dbb5e68bae0779a4903a3a3ae758177496e3c03aa56455ad88a617baefae8f4a9f7e887ff960a06509ff9f9
SSDEEP 3072:mEGh0o9lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGTlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{31615E6B-E0FA-47fc-8596-784FEE597650}.exe

Path C:\Windows\{31615E6B-E0FA-47fc-8596-784FEE597650}.exe
Size 344KB
SHA256 5beebd249befd9ff5fa42a2400c0cd6674d43ae36b41c01acf3518153305584f
MD5 c5db4c60fed22ccafb854e2aac1ab11c
SHA1 81345cae8ac589c32a0ef865f629a9be62d37d55
SHA512 4c491f8d6056d9d4e33514a4972ba432c3065e81f39cb7247ac9c42421d6f6383738695e3a399e9d2a322478a5cab48fc55a397d26d237808823590f9d9fb1f4
SSDEEP 3072:mEGh0oUlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGqlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe

Path C:\Windows\{56857A33-FEE2-48f6-9692-DBBD34B81622}.exe
Size 344KB
SHA256 0e07fa7e1d035ebc7a484ae6d58d4d862265b5dcb8534a0df2a0f7f9893214fe
MD5 b5dd2c02a505e987008cd83653c9dd4f
SHA1 4997b133d15024cd1f9a5068879d4107ed7a3cba
SHA512 c187395ba5e0c006dff327617c72915648e84eb8b41e86a92d45aa7a50bd0dabb0ecc33ca682bb6bd4005c5295bcc03674e731b7ae289f1889db2d88c7c30f20
SSDEEP 3072:mEGh0o+lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG0lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{6951782D-3638-45fd-A7D0-AC92C4996330}.exe

Path C:\Windows\{6951782D-3638-45fd-A7D0-AC92C4996330}.exe
Size 344KB
SHA256 f7e06e4bf0ce49706b9568604533757ff8be112e4c7c1b6f1f214f600f8163e4
MD5 91b0fa20841f300e9a4d5b0a7177d36c
SHA1 cfca41427480706f2d21cc63936d33206943b72c
SHA512 057d80be9a916a932717bcb827304d9a862a6d8ece963a3339c0a76e194a996cde60e17b33424a9e085dc8917168ce8b8777f133ffdca6135f601ee65810eb92
SSDEEP 3072:mEGh0ollEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGPlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe

Path C:\Windows\{7A5698DE-2A75-4549-B7E2-400CF2D9CE3C}.exe
Size 344KB
SHA256 8cdf06ad344b96f89a202f956dba95133b9ddcedc02a21f51dba94c17065da30
MD5 9db4e933de0d0c1a60512c2c128bdf9c
SHA1 516932a85b79816544aca1e4c8964f5b8cc88090
SHA512 392e8ca46daee90702f075a9cf672bf4a67840dbc70277ff829f67ae1b70f09d420b872091e96f48b367696c57169ddd776029fba3999a68fc4629deae3ecce9
SSDEEP 3072:mEGh0omlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGMlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe

Path C:\Windows\{817474AD-5BC8-41bb-9E17-83239F5560FB}.exe
Size 344KB
SHA256 c1d8cf6e132431ad2d7ca2c8e760815614ae3f3c2be518f672349e66878d4bf6
MD5 445b369a4916f43843476358c669d1be
SHA1 1232101024acea1e4c71333e2fbdf569499276e4
SHA512 1740c6146ba3d32ee38afff9869b2360bfeff151121cf16f34c7ff3a49afc9dc4f1a82079b0416bfceef5232e73b49d6080eb2d285d53e2285658ecdd60abdb9
SSDEEP 3072:mEGh0o+lEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGIlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe

Path C:\Windows\{A59AC3B0-C868-42c9-A9EC-EEB1178A6C99}.exe
Size 344KB
SHA256 3727e163e1d06da414db367a7f86044cfac556ffd0927e78bba93c8dbf329c26
MD5 93ab66c351971c0f0d38d4ef2dd1221c
SHA1 1cf06312e13f6aa31f8e324fbb08f7cbffe3a279
SHA512 37095194f4dd11b553b560374235dd2d4cea9141a49092c3a3e7ae38bf3d7ff71d7722eaef46b61b60dc68121783a2aa22defff232235eb4412591270121826b
SSDEEP 3072:mEGh0oulEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGwlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AA641180-53F7-4dae-8225-211066583A32}.exe

Path C:\Windows\{AA641180-53F7-4dae-8225-211066583A32}.exe
Size 344KB
SHA256 8bdd412337ab46507e083673fe48833993b95b444d9fdd513c922da22e5edc85
MD5 8a345243f148e206c2670c6b6c997451
SHA1 d624e9fe0c2712d83407eb5cd4896dc4bc5be24f
SHA512 55ad6093091f9a24569ed9d5c4842dd17fa2c446fc72f7f3924cef7625fca56f2b83ec3c6accb2e83b23697381b5d3b9da62b83de3610a3ee98e6f92e37f7ecd
SSDEEP 3072:mEGh0oclEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEG2lqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe

Path C:\Windows\{B5360CE1-9A3C-4abf-A2CF-934FD3D3418E}.exe
Size 344KB
SHA256 f23cdf523e95fc1f9e9acc9b7d6142d3f2d875c7e1a98299eb312a18f5b139de
MD5 a6738e9ecc27507ce0b2208c3ac403ad
SHA1 62958a47ecde0ca6e404679eb88d8fdf98f1508c
SHA512 547a6dbeb8c67cb7fbbc555588d2467be4d8d084ff29124930af760c25fcc2ac4df36a17ba09250756603f79ac80a952d8568d515ac5a6d7a75cf530384b2ea9
SSDEEP 3072:mEGh0oIlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGWlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe

Path C:\Windows\{D2DFB62C-C452-412e-8C5B-D634379D090A}.exe
Size 344KB
SHA256 6c12ea82169944d30a97c22e678fa69ad44f9644b0c18d0467dafbd96320847d
MD5 5ebe61a421087a21d0f6fcb86fcbb4f6
SHA1 a3b3f773cd41590b80209776508836ab3ba3488f
SHA512 04d247f462c99b20f135204b67a2865ede9a9ca1ad066af518d028f702820359d98b25cb5d34c82d74bdafbbac460e545f215a60d1056077bd36a47d18a15168
SSDEEP 3072:mEGh0ozlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGhlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe

Path C:\Windows\{FABBBA35-F1B3-44fa-81A8-4007BC76590A}.exe
Size 344KB
SHA256 2358cbe4bf829eedc74a86e3a7b8e197c3c43ad4238430c10d5ea05e48bd46db
MD5 7be5dcd7ac8266a384d7f09f49897a70
SHA1 bea029936963bb875f1e515041b0d40375efb3da
SHA512 d40170e4bc08c75bfdbf324cd15f5f412d182f997dac8179e7cc59804b7710e337212641fd806d4577d884a5383a22492e5c33b7ee0ab7de8679c244a99c79f7
SSDEEP 3072:mEGh0oVlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGHlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FD76A468-1329-403c-A4FD-4798421DD197}.exe

Path C:\Windows\{FD76A468-1329-403c-A4FD-4798421DD197}.exe
Size 344KB
SHA256 99970b442377cccac912ee4e8da3b9ccc57db1677c677ea9dce13ee7dd7fe9b8
MD5 e9da49993a961cb8f07cdc607632148a
SHA1 79ddff9b3603c491b715c92a4a600729a0036e80
SHA512 30397eedd119df51a32339a108a9beea44562c6bf36224d41828d0014e759561f79cfe9d7600178b85afd91ce8a8aad5090e1c659c7b93bf7f59e5f2bad4ff85
SSDEEP 3072:mEGh0oolEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGKlqOe2MUVg3v2IneKcAEcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads