ed2b610d2e804064a0445c3764790e1677bd8d476db0da7a6a2957f66d27b06f

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
Size

408KB
MD5

15e6527190928265146135e5a096a12b
SHA1

8d68f1f519f97dcb4f28f8c8bc0128e524996481
SHA256

ed2b610d2e804064a0445c3764790e1677bd8d476db0da7a6a2957f66d27b06f
SHA512

7dd806c5c84d3b3cfc3bcf2335b19aac46aa0fd8972f8ace2d2edd60bf09f92500b2301b8bf0a1253a05c75d60e0e795504e0be1bbc3fbd30a04616834bea230
SSDEEP

3072:CEGh0oJl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGDldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012262-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0016000000015db4-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012262-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0017000000015db4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015e41-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015e41-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0018000000015db4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015e41-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0019000000015db4-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015e41-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001a000000015db4-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}\stubpath = "C:\\Windows\\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe"	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}\stubpath = "C:\\Windows\\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe"	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}	{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}\stubpath = "C:\\Windows\\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe"	{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}\stubpath = "C:\\Windows\\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe"	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5F01428-AD6C-481b-996F-118E10AFC55F}	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5F01428-AD6C-481b-996F-118E10AFC55F}\stubpath = "C:\\Windows\\{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe"	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E351B34-E4A4-4229-AE21-210005C223F4}\stubpath = "C:\\Windows\\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe"	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}\stubpath = "C:\\Windows\\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe"	{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}\stubpath = "C:\\Windows\\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe"	{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E6DC068-227E-4abd-8E79-06923F79C0E3}	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FCC90FD-5233-4d7e-AF61-945E9395856B}	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FCC90FD-5233-4d7e-AF61-945E9395856B}\stubpath = "C:\\Windows\\{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe"	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E351B34-E4A4-4229-AE21-210005C223F4}	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}	{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E6DC068-227E-4abd-8E79-06923F79C0E3}\stubpath = "C:\\Windows\\{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe"	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}\stubpath = "C:\\Windows\\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe"	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}	{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe

Deletes itself 1 IoCs

pid	Process
3012	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
2152	{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
876	{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
2964	{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe
2948	{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe	{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
File created	C:\Windows\{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
File created	C:\Windows\{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
File created	C:\Windows\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
File created	C:\Windows\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
File created	C:\Windows\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe	{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
File created	C:\Windows\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe	{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe
File created	C:\Windows\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
File created	C:\Windows\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
File created	C:\Windows\{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
File created	C:\Windows\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
Token: SeIncBasePriorityPrivilege	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
Token: SeIncBasePriorityPrivilege	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
Token: SeIncBasePriorityPrivilege	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
Token: SeIncBasePriorityPrivilege	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
Token: SeIncBasePriorityPrivilege	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
Token: SeIncBasePriorityPrivilege	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
Token: SeIncBasePriorityPrivilege	2152	{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
Token: SeIncBasePriorityPrivilege	876	{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
Token: SeIncBasePriorityPrivilege	2964	{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2632	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	28
PID 2256 wrote to memory of 2632	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	28
PID 2256 wrote to memory of 2632	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	28
PID 2256 wrote to memory of 2632	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	28
PID 2256 wrote to memory of 3012	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	29
PID 2256 wrote to memory of 3012	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	29
PID 2256 wrote to memory of 3012	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	29
PID 2256 wrote to memory of 3012	2256	2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe	29
PID 2632 wrote to memory of 2688	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	32
PID 2632 wrote to memory of 2688	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	32
PID 2632 wrote to memory of 2688	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	32
PID 2632 wrote to memory of 2688	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	32
PID 2632 wrote to memory of 2712	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	33
PID 2632 wrote to memory of 2712	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	33
PID 2632 wrote to memory of 2712	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	33
PID 2632 wrote to memory of 2712	2632	{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe	33
PID 2688 wrote to memory of 2404	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	34
PID 2688 wrote to memory of 2404	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	34
PID 2688 wrote to memory of 2404	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	34
PID 2688 wrote to memory of 2404	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	34
PID 2688 wrote to memory of 2460	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	35
PID 2688 wrote to memory of 2460	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	35
PID 2688 wrote to memory of 2460	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	35
PID 2688 wrote to memory of 2460	2688	{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe	35
PID 2404 wrote to memory of 840	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	36
PID 2404 wrote to memory of 840	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	36
PID 2404 wrote to memory of 840	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	36
PID 2404 wrote to memory of 840	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	36
PID 2404 wrote to memory of 1516	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	37
PID 2404 wrote to memory of 1516	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	37
PID 2404 wrote to memory of 1516	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	37
PID 2404 wrote to memory of 1516	2404	{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe	37
PID 840 wrote to memory of 2368	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	38
PID 840 wrote to memory of 2368	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	38
PID 840 wrote to memory of 2368	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	38
PID 840 wrote to memory of 2368	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	38
PID 840 wrote to memory of 1852	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	39
PID 840 wrote to memory of 1852	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	39
PID 840 wrote to memory of 1852	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	39
PID 840 wrote to memory of 1852	840	{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe	39
PID 2368 wrote to memory of 1060	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	40
PID 2368 wrote to memory of 1060	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	40
PID 2368 wrote to memory of 1060	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	40
PID 2368 wrote to memory of 1060	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	40
PID 2368 wrote to memory of 2656	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	41
PID 2368 wrote to memory of 2656	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	41
PID 2368 wrote to memory of 2656	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	41
PID 2368 wrote to memory of 2656	2368	{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe	41
PID 1060 wrote to memory of 1480	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	42
PID 1060 wrote to memory of 1480	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	42
PID 1060 wrote to memory of 1480	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	42
PID 1060 wrote to memory of 1480	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	42
PID 1060 wrote to memory of 2028	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	43
PID 1060 wrote to memory of 2028	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	43
PID 1060 wrote to memory of 2028	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	43
PID 1060 wrote to memory of 2028	1060	{6E351B34-E4A4-4229-AE21-210005C223F4}.exe	43
PID 1480 wrote to memory of 2152	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	44
PID 1480 wrote to memory of 2152	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	44
PID 1480 wrote to memory of 2152	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	44
PID 1480 wrote to memory of 2152	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	44
PID 1480 wrote to memory of 1808	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	45
PID 1480 wrote to memory of 1808	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	45
PID 1480 wrote to memory of 1808	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	45
PID 1480 wrote to memory of 1808	1480	{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_15e6527190928265146135e5a096a12b_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
  C:\Windows\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
    C:\Windows\{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
      C:\Windows\{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
        
        C:\Windows\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
        
        C:\Windows\{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
        
        C:\Windows\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
        
        C:\Windows\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
        
        C:\Windows\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Windows\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
        
        C:\Windows\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe
        
        C:\Windows\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Windows\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe
        
        C:\Windows\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe
        12⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F51CD~1.EXE > nul
        12⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC1F2~1.EXE > nul
        11⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0CF59~1.EXE > nul
        10⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D956~1.EXE > nul
        9⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E351~1.EXE > nul
        8⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FCC9~1.EXE > nul
        7⤵
        
        PID:2656
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32DF3~1.EXE > nul
        6⤵
        
        PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E6DC~1.EXE > nul
        5⤵
        
        PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A5F01~1.EXE > nul
      4⤵
      PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3A70E~1.EXE > nul
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0CF594C8-A955-40ba-A4BB-9118CB140F0B}.exe

Filesize
408KB

MD5
cc89396b74a7f9cc19d2022444655b50

SHA1
5838668cd33da1b4a7216e113d6ac97bc02d3b78

SHA256
3caecbf8a47a19a5971d747f9ba0de7178307956106ce6c164d603f9fd21ca8d

SHA512
88bddc8b22212c786ddbe78962273a5505159699c0413c913b181fc53d69f62472fdf964e886aa492a0466f09190e39862ea52d3fd87ea4083c7e16a80f6f325

Download Submit
C:\Windows\{2D95609D-28B4-4e68-AF28-6D6E32F670A2}.exe

Filesize
408KB

MD5
ebd044721daa756d4b5753bcec28217c

SHA1
bd1ee6270c12d4328ac53839c2b6ca2f7d2931fa

SHA256
63f95754a7c90a5c7e071e164fa7df39305fe63f056756fc979e38d37eb9346b

SHA512
9f9c038a910296daeb70c5a84cd4c4751cb6e2f95945d72f7a53547034b94b6ee9ea52d0c21b8a1e4fbab2ea3a362df31cfc97f7748748418ed7f08c65ede771

Download Submit
C:\Windows\{32DF392F-4BC7-4ece-BDE7-306429D67D3A}.exe

Filesize
408KB

MD5
4ff324fd9d3627f1b5c2a329661d5668

SHA1
36bff1fafd58df092f3421dc146131579cc340ad

SHA256
bb903ac69468508d8449522a44a4126c427573783b7a246a6707f1166daedb7f

SHA512
4ae963244a22809b584bd35237da636b8fd59431e4fa4eab3e639e8c9688647dcc7b5ad445559d40a83c3a651fb32eab06deadb64877ec27622e761cd32d9f40

Download Submit
C:\Windows\{3A70EF37-ED60-4d22-9D6E-A4D86B5E1038}.exe

Filesize
408KB

MD5
92dddde45e6bfbf7f62a63124e05d668

SHA1
4151270754b2ada94a2684a305741ff88a770d9f

SHA256
28a88a5f1fdad889bba71f886d33aebb3b035a1b724c094438f2a4fa84a6215f

SHA512
fe274c95ef55faf0c8511f3f1f91a5188fcd87be45509ee1b992f023fd567d3d2a08c292b05497addd40d69c033e2c74a4a8b384321d4d4822600963a9fa4bc3

Download Submit
C:\Windows\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe

Filesize
408KB

MD5
ee7230cf7502fa45fd6e6f331cd03e53

SHA1
64f28ef0ddd041722fd6cbd9ecd4094f697e4926

SHA256
7436133cc05c1322e69bdd11f6336a0defdc6d71fa45c679e3211731d6b75ec9

SHA512
60ad64f917f57672eac03ebe974d68ad9b2361201493f004893d2ac0f213d945e1a3b3043f425ba1609b9da1ae088d1896242983d918c74b703db955bf2fb499

Download Submit
C:\Windows\{6E351B34-E4A4-4229-AE21-210005C223F4}.exe

Filesize
236KB

MD5
df0c506d7c78da204dfbe31254c91ce1

SHA1
d498545a182aef754598a8f16ec0bc64312153e4

SHA256
ccf058da68af16bf95cfe4da066da8a6958ba28bd039642a7f850ee7f279283e

SHA512
c8d3152719c8e98de215e7cb40967b7cd71a33367b938c7831178eea40de52f72001cd21da1a59cc6251cea6217a70cff3d3df2533b039c453c2aa56060b58bc

Download Submit
C:\Windows\{6E6DC068-227E-4abd-8E79-06923F79C0E3}.exe

Filesize
408KB

MD5
230ef4ed29317b244eaed888d3046bc5

SHA1
54a38e1a2bfacb73d97db2e0ac07fd4d0382bcce

SHA256
c724cb7eddf8880be2e0a72b8e8105f1398fd7278d982b1f8c4df03e0d8b1379

SHA512
4b7f9fefe7e99ce98ccac610e0700b48ee167a2fa5ad7a8aa5ea3a7a45cc5f915e149c432fdb5e80228779003fcd68d8d62c0b4f05067d5910ac08006b91bd48

Download Submit
C:\Windows\{7FCC90FD-5233-4d7e-AF61-945E9395856B}.exe

Filesize
408KB

MD5
0a7c79561fdc5ba25c818f3ef624b6ad

SHA1
57f15ababea562c271426b8ad3aa4ad65e1a35c4

SHA256
a4f844bd9c039d46b12f758501550269f63a2c8314b3147f2c65fd3cbf04219c

SHA512
49ea58db17d8d3b6fb833e96d8bdc798216c65c002e7a0c2913c229153c2f4161c5d0fa0264818c3c68ad98ab7049e081e2d75a8fa0e9c55e25efdb00abc4144

Download Submit
C:\Windows\{A5F01428-AD6C-481b-996F-118E10AFC55F}.exe

Filesize
408KB

MD5
4b512accdb1e040bc7d8193b857f1e46

SHA1
e56322a002409021cb0e13fe4d50c32d0dfb0249

SHA256
f70c12f4c04bfd91d67eb2f45f3a5a346b2ce3f0fe66b225c605f92d89c66f36

SHA512
6b43d1a8a7607ac1f1e3b86ae5457e7a88cac4b9ac5bafbbaea232952f2faa91d712af7a81d3c7023f32a78c8581f77b880ab43b1258f7461b203fc2d9e87a18

Download Submit
C:\Windows\{BC1F2485-6132-40a3-8D9A-15FDA7DC5A8E}.exe

Filesize
408KB

MD5
9b5661625447c1c79fa99715d69b678d

SHA1
153bfdbb5fbda1b7ec54bb2a607a9f2b9f40c154

SHA256
176083f40c5f737b315da6e90923a21ca534b43cce5fbddff6d20486eafccd8a

SHA512
faa010e124b86d5c7451eba355ad87414aafdec2adce05ee3db0a5319c1c8d17e8e1b41ee5164b170052d3444da9ffa51e9aeed47138b5ab9695c29cb51c875c

Download Submit
C:\Windows\{D47B30B3-D469-49e5-9B68-2AA10BBFEADB}.exe

Filesize
408KB

MD5
204e346a72eafe47e5e9f047022effed

SHA1
86c2534cb39c32b623f3f80f74d7881b03819f4d

SHA256
d62ec197600da1d775abcf886f74e6f2e19ea3e393d26c3bae49537621939c64

SHA512
5261b162eefa15be8efdbfe660cea0973d7bdb7a4bda24d1b71c10e8fef0783d21d2c7ce6b15d1b36ec4091b54e97158386aa4c06bb96f77136759784fe075f2

Download Submit
C:\Windows\{F51CD42E-D3C7-444d-BF83-EE33E83F763A}.exe

Filesize
408KB

MD5
bfad3c9bfd399a39137723731dcbd080

SHA1
836b44293e9a2b332d9beda25ba1384e6e149fd5

SHA256
5064b087fcefd72ea57c6fa3ab44f78f09c7204272fb371d788bb0d2a2c09956

SHA512
90c2e1be56c701f8a8ad59ec7ef2880d6faa45214af06e5c65064a77acc94b51376d67f0878730277634b118856dcc13ff783acf360f7f842f6f3edd070916cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads