a02df1ba8a74e6ef920022662d4d1fc6a1799949f26a824a97cadb52bb93aab4

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
Size

168KB
MD5

34122dba6b37e3e9b4e4ab147d159bc9
SHA1

3ef895ba80f5f1301b25867e29e892f587a96737
SHA256

a02df1ba8a74e6ef920022662d4d1fc6a1799949f26a824a97cadb52bb93aab4
SHA512

ab7e2b4ea8f62bfbd541446875712651db8e08b4a203584a42e66fc0ecd75f38b2a1de1886b06bac7638493aefb4b27783f8b2e9538e5598f4f49075b59d0379
SSDEEP

1536:1EGh0oRlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oRlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000131a1-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012256-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f3-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f3-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012256-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f3-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0036000000016270-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}\stubpath = "C:\\Windows\\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe"	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}\stubpath = "C:\\Windows\\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe"	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}\stubpath = "C:\\Windows\\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe"	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}\stubpath = "C:\\Windows\\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe"	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36C45905-E646-4054-B3B3-72CB96CE9B2D}	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36C45905-E646-4054-B3B3-72CB96CE9B2D}\stubpath = "C:\\Windows\\{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe"	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}\stubpath = "C:\\Windows\\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe"	{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{865144E4-05DE-42bd-8F34-8DFC43D960F2}	{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6011C23-3111-4cd7-9F55-1EE9BC813779}	{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED03D010-C416-439f-9B1A-60C76F751901}	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{791D953B-568E-43d7-9C9A-066CFA749DF6}\stubpath = "C:\\Windows\\{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe"	{ED03D010-C416-439f-9B1A-60C76F751901}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{865144E4-05DE-42bd-8F34-8DFC43D960F2}\stubpath = "C:\\Windows\\{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe"	{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6011C23-3111-4cd7-9F55-1EE9BC813779}\stubpath = "C:\\Windows\\{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe"	{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}\stubpath = "C:\\Windows\\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe"	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED03D010-C416-439f-9B1A-60C76F751901}\stubpath = "C:\\Windows\\{ED03D010-C416-439f-9B1A-60C76F751901}.exe"	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{791D953B-568E-43d7-9C9A-066CFA749DF6}	{ED03D010-C416-439f-9B1A-60C76F751901}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}	{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe
2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
1100	{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
1832	{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
2288	{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
1724	{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
File created	C:\Windows\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
File created	C:\Windows\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe	{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
File created	C:\Windows\{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe	{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
File created	C:\Windows\{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe	{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
File created	C:\Windows\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
File created	C:\Windows\{ED03D010-C416-439f-9B1A-60C76F751901}.exe	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
File created	C:\Windows\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
File created	C:\Windows\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
File created	C:\Windows\{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	{ED03D010-C416-439f-9B1A-60C76F751901}.exe
File created	C:\Windows\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
Token: SeIncBasePriorityPrivilege	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe
Token: SeIncBasePriorityPrivilege	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
Token: SeIncBasePriorityPrivilege	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
Token: SeIncBasePriorityPrivilege	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
Token: SeIncBasePriorityPrivilege	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
Token: SeIncBasePriorityPrivilege	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
Token: SeIncBasePriorityPrivilege	1100	{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
Token: SeIncBasePriorityPrivilege	1832	{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
Token: SeIncBasePriorityPrivilege	2288	{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3032	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	28
PID 2176 wrote to memory of 3032	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	28
PID 2176 wrote to memory of 3032	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	28
PID 2176 wrote to memory of 3032	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	28
PID 2176 wrote to memory of 2544	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	29
PID 2176 wrote to memory of 2544	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	29
PID 2176 wrote to memory of 2544	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	29
PID 2176 wrote to memory of 2544	2176	2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe	29
PID 3032 wrote to memory of 2736	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	30
PID 3032 wrote to memory of 2736	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	30
PID 3032 wrote to memory of 2736	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	30
PID 3032 wrote to memory of 2736	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	30
PID 3032 wrote to memory of 2856	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	31
PID 3032 wrote to memory of 2856	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	31
PID 3032 wrote to memory of 2856	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	31
PID 3032 wrote to memory of 2856	3032	{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe	31
PID 2736 wrote to memory of 2580	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	32
PID 2736 wrote to memory of 2580	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	32
PID 2736 wrote to memory of 2580	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	32
PID 2736 wrote to memory of 2580	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	32
PID 2736 wrote to memory of 2708	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	33
PID 2736 wrote to memory of 2708	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	33
PID 2736 wrote to memory of 2708	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	33
PID 2736 wrote to memory of 2708	2736	{ED03D010-C416-439f-9B1A-60C76F751901}.exe	33
PID 2580 wrote to memory of 2648	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	36
PID 2580 wrote to memory of 2648	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	36
PID 2580 wrote to memory of 2648	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	36
PID 2580 wrote to memory of 2648	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	36
PID 2580 wrote to memory of 2784	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	37
PID 2580 wrote to memory of 2784	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	37
PID 2580 wrote to memory of 2784	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	37
PID 2580 wrote to memory of 2784	2580	{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe	37
PID 2648 wrote to memory of 524	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	38
PID 2648 wrote to memory of 524	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	38
PID 2648 wrote to memory of 524	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	38
PID 2648 wrote to memory of 524	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	38
PID 2648 wrote to memory of 2032	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	39
PID 2648 wrote to memory of 2032	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	39
PID 2648 wrote to memory of 2032	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	39
PID 2648 wrote to memory of 2032	2648	{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe	39
PID 524 wrote to memory of 1652	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	40
PID 524 wrote to memory of 1652	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	40
PID 524 wrote to memory of 1652	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	40
PID 524 wrote to memory of 1652	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	40
PID 524 wrote to memory of 2164	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	41
PID 524 wrote to memory of 2164	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	41
PID 524 wrote to memory of 2164	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	41
PID 524 wrote to memory of 2164	524	{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe	41
PID 1652 wrote to memory of 848	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	42
PID 1652 wrote to memory of 848	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	42
PID 1652 wrote to memory of 848	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	42
PID 1652 wrote to memory of 848	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	42
PID 1652 wrote to memory of 1976	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	43
PID 1652 wrote to memory of 1976	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	43
PID 1652 wrote to memory of 1976	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	43
PID 1652 wrote to memory of 1976	1652	{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe	43
PID 848 wrote to memory of 1100	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	44
PID 848 wrote to memory of 1100	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	44
PID 848 wrote to memory of 1100	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	44
PID 848 wrote to memory of 1100	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	44
PID 848 wrote to memory of 2644	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	45
PID 848 wrote to memory of 2644	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	45
PID 848 wrote to memory of 2644	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	45
PID 848 wrote to memory of 2644	848	{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_34122dba6b37e3e9b4e4ab147d159bc9_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
  C:\Windows\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\{ED03D010-C416-439f-9B1A-60C76F751901}.exe
    C:\Windows\{ED03D010-C416-439f-9B1A-60C76F751901}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
      C:\Windows\{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
        
        C:\Windows\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Windows\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
        
        C:\Windows\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
        
        C:\Windows\{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
        
        C:\Windows\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
        
        C:\Windows\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
        
        C:\Windows\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
        
        C:\Windows\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
        
        C:\Windows\{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
        
        C:\Windows\{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
        
        C:\Windows\{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe
        
        C:\Windows\{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe
        12⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{86514~1.EXE > nul
        12⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B191D~1.EXE > nul
        11⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA659~1.EXE > nul
        10⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F575C~1.EXE > nul
        9⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{36C45~1.EXE > nul
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB7E4~1.EXE > nul
        7⤵
        
        PID:2164
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12F61~1.EXE > nul
        6⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{791D9~1.EXE > nul
        5⤵
        
        PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{ED03D~1.EXE > nul
      4⤵
      PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{36A0C~1.EXE > nul
    3⤵
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{12F61F7D-333E-4b05-B49E-1801FDC85BAF}.exe

Filesize
168KB

MD5
0f7ab206589d23fc74af44eeee5a9738

SHA1
0cbc30709b56b46504566b8ec2e5ff36629ec4fa

SHA256
9d39e150ac7abfeae6a9ded43a6e223028a7793276966f25268d5887a8ee08b3

SHA512
5049bdfa27979e7276c1a876784dfcd23b142dfa57f86d3331cca16831952c463be32fbc7f0208f47362f93fbf498332cce702562af8c75080791eb41adf1d37

Download Submit
C:\Windows\{36A0C696-2F75-4c9d-8BFE-B1020E3FDEA7}.exe

Filesize
168KB

MD5
164f5fd1e2948b7497f1938ea4fd7f77

SHA1
16a2d895b2ca6ec648d081e752eef60ee85bd1bb

SHA256
772942cac0e24815cde85076b8d6261a77738bf1a0de79dfd132d93538d2caeb

SHA512
e18c960ace4f00458433341a1ea0e03a868d07bcc7a3393940df0fcbb9d3570ae07becaa65565a5eaf91d9dcaf84dbc8e2997367ff63e97782715f090aacadf5

Download Submit
C:\Windows\{36C45905-E646-4054-B3B3-72CB96CE9B2D}.exe

Filesize
168KB

MD5
362f71fa4c464e42e011ce71292a1f2f

SHA1
829f222a85b4abadd318ae836355071382db4149

SHA256
40b1ef913fe7c72c9a01105082c011d28d931ae66d265569889229c02ffa7ee1

SHA512
fa0ab7f34d18b38cf2bf0d0d168a4952c61034469ad62120b7f57b2a07e3170053633fe28562bec9d64de4253eb9a6adab2b0e957a5ea8c2355a78a169937c15

Download Submit
C:\Windows\{791D953B-568E-43d7-9C9A-066CFA749DF6}.exe

Filesize
168KB

MD5
3beaeb09cad79d30dcd76659a6e574b2

SHA1
0241d5e7bdb40177dfedf0e51c0163bd018034ca

SHA256
960ce76205911ddf1d567dfba8dd1e975e4634e697ae77f21c19d3c8ffc49fee

SHA512
51e9f01495ae5cd2e26e2855d240661cc9f10d04a04c8d89d54920b7f2465e64fce97324d377c6f07d67699eeb569a68db2f7c1d076f8043ed9a8fc3ed3dd2ed

Download Submit
C:\Windows\{865144E4-05DE-42bd-8F34-8DFC43D960F2}.exe

Filesize
168KB

MD5
c3cd1bd4550d11ea83fdf5648fe17a0d

SHA1
6d3420107a97bd11b8401deea7f7c137224afd17

SHA256
74d4a890317a87df233cfd4d731199fb3ea5d1dd984c1cb85070f9127c03b748

SHA512
be137705e0814c6ce737dd61712a75625d96f6ab8fb3b16687060f164e4016e07d08dfe3225714faed6f35182e4fcf5c6e8660ad4af003c3e0e79bbf5435f399

Download Submit
C:\Windows\{B191DC0C-7FAC-4397-8719-C6AF9BB578D8}.exe

Filesize
168KB

MD5
7f2a20aa74f3afb36cd505162505b9ed

SHA1
f1c98d1f14f46e04f1182861ec30bb5c6d6576fd

SHA256
e683e7c42239914118392f8f5da335bcb8b68ace4a77cb6e02a5d339f9b3c02e

SHA512
209687eb5d5b84cc64ddf9c064c28b46eb7057ed733ceffb6c897f05725a56a8b8b24e30acbb1b54d5ba2c70ef1cd12ddc26edba92d7402ac4c4dbad047a18df

Download Submit
C:\Windows\{CA6593C7-B4B4-4eb2-96F6-44651F5BA9D1}.exe

Filesize
168KB

MD5
3f0050fa021f79f23923d822d53f8bc5

SHA1
a8473a9383378e4a8b165222d38859c4567913c9

SHA256
971dab8d89e3926e75f8cf43bafc456ba4052cf9b122dafe9b64d82c709d2516

SHA512
de97b6efff8ad17650fe209b562501841188b975329d442ffe472f7bf4bdefd056df6cc2674d712a0cdbdb461e88a073c32a4e88ad32d597e79cc6f2f4edf552

Download Submit
C:\Windows\{CB7E4C4C-E927-4f61-A3F5-462ED74660A7}.exe

Filesize
168KB

MD5
b80b1cd7bab3d0dcffba0a37d99a304b

SHA1
08abfc0ecb22e3ac00a4618a334c8dddbb1ba829

SHA256
ebf1a3ec12c3c651a5133ba4eec52b39011d6a9a4c2b92e62d980cb4d059e201

SHA512
b5c2189c1f6dc86beeb25d477e3e088105f7894efa71afd777dc59968e65a556a770b8abf8037a4404777d44cc9cbf4d454d682e1bb50f3120f9b7334618645e

Download Submit
C:\Windows\{ED03D010-C416-439f-9B1A-60C76F751901}.exe

Filesize
168KB

MD5
749aa825f410bbdcbb419963b7cf376f

SHA1
e7dc4c9e16a8be2b23f174c115e39b0f53b2ca65

SHA256
01bf74c7859f8c1b87b02ef9f08f73dbcb9920b07ffa9faf96c8e94c007460b0

SHA512
6ee60694e33eb32ba1669f25bf94a4bb9914eb2300ce9f58731a7f80183782421f014f8b6045110200414342d24f9c7d3d2b905cb3881b0880ca8777940096b6

Download Submit
C:\Windows\{F575C566-4714-43f8-BEB0-6B2EE73FC5C5}.exe

Filesize
168KB

MD5
b26da5a5703af1e9063439d4a6af5400

SHA1
0736416f5ec951de9eb98b3b60d5df39499b8c22

SHA256
d1e1ebb5d46bfd4020bcde0cdd893c40507bdbb9552a8450daf97e95d7d8eac4

SHA512
f713eb1483a780cbc94de02bd9eca9a038a646a05ccb2b2a08a1bcb95ec57c55a23a3af3cd12c77fc7e616431783bcd997df1085d9f9e5fe93fa1a82c857b926

Download Submit
C:\Windows\{F6011C23-3111-4cd7-9F55-1EE9BC813779}.exe

Filesize
168KB

MD5
1985567d5e18d0547d4debb6504e304b

SHA1
22b70947600527510fdb86d2d7447c9cc964383c

SHA256
2c6950c5ba8025ad12b92e58f15a464c851fe23933125f86f5a9de66247a15d6

SHA512
6d98050cb325092334d54e3e79dee649ca30aadaf5059128d256069ea04cf6a972d7c65935d8d3a4abf7934a483675c31616ca265a1a08c1e2e3b7d4efede8b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads