04caf0572196f2df5735546a2d5fb4c2bd6cce0e697a02b4852d55c2997de12a

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
Size

168KB
MD5

8045184ac3be40b1d64b628d49dfbcc9
SHA1

991bbe769ce24e7f2bd09c7c30667f7311eadf0b
SHA256

04caf0572196f2df5735546a2d5fb4c2bd6cce0e697a02b4852d55c2997de12a
SHA512

3121b8f5db039fae0e648148303169144adf25aaa147b642e1c04ce709b5a6aadfd5695691e173ffdaad0e4360a31b33c6ae63a6d5ade2ec5eb917ba0e02de98
SSDEEP

1536:1EGh0obli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0obliOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012262-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0016000000015db4-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012262-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0017000000015db4-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012262-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012262-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0018000000015db4-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012262-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0019000000015db4-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012262-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001a000000015db4-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}\stubpath = "C:\\Windows\\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe"	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}	{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}	{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A024B3E6-1175-4d2e-B183-298974F63162}\stubpath = "C:\\Windows\\{A024B3E6-1175-4d2e-B183-298974F63162}.exe"	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0B179B0-1748-4211-9A8F-D279D033A6FE}\stubpath = "C:\\Windows\\{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe"	{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}\stubpath = "C:\\Windows\\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe"	{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10B5007E-4E0A-4674-9792-72B8586A116C}	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C1F37F0-4878-4e68-9E12-66F3786728BD}	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}\stubpath = "C:\\Windows\\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe"	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}\stubpath = "C:\\Windows\\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe"	{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}\stubpath = "C:\\Windows\\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe"	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}	{A024B3E6-1175-4d2e-B183-298974F63162}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}\stubpath = "C:\\Windows\\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe"	{A024B3E6-1175-4d2e-B183-298974F63162}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10B5007E-4E0A-4674-9792-72B8586A116C}\stubpath = "C:\\Windows\\{10B5007E-4E0A-4674-9792-72B8586A116C}.exe"	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C1F37F0-4878-4e68-9E12-66F3786728BD}\stubpath = "C:\\Windows\\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe"	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}\stubpath = "C:\\Windows\\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe"	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A024B3E6-1175-4d2e-B183-298974F63162}	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0B179B0-1748-4211-9A8F-D279D033A6FE}	{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe

Deletes itself 1 IoCs

pid	Process
2488	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe
2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe
2184	{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
1824	{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
2492	{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
2920	{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	{A024B3E6-1175-4d2e-B183-298974F63162}.exe
File created	C:\Windows\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
File created	C:\Windows\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe	{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
File created	C:\Windows\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe	{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
File created	C:\Windows\{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe	{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
File created	C:\Windows\{A024B3E6-1175-4d2e-B183-298974F63162}.exe	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
File created	C:\Windows\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
File created	C:\Windows\{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
File created	C:\Windows\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
File created	C:\Windows\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
File created	C:\Windows\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe
Token: SeIncBasePriorityPrivilege	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
Token: SeIncBasePriorityPrivilege	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
Token: SeIncBasePriorityPrivilege	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
Token: SeIncBasePriorityPrivilege	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
Token: SeIncBasePriorityPrivilege	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
Token: SeIncBasePriorityPrivilege	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe
Token: SeIncBasePriorityPrivilege	2184	{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
Token: SeIncBasePriorityPrivilege	1824	{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
Token: SeIncBasePriorityPrivilege	2492	{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1396	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	28
PID 2244 wrote to memory of 1396	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	28
PID 2244 wrote to memory of 1396	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	28
PID 2244 wrote to memory of 1396	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	28
PID 2244 wrote to memory of 2488	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	29
PID 2244 wrote to memory of 2488	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	29
PID 2244 wrote to memory of 2488	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	29
PID 2244 wrote to memory of 2488	2244	2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe	29
PID 1396 wrote to memory of 2628	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	32
PID 1396 wrote to memory of 2628	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	32
PID 1396 wrote to memory of 2628	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	32
PID 1396 wrote to memory of 2628	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	32
PID 1396 wrote to memory of 2592	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	33
PID 1396 wrote to memory of 2592	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	33
PID 1396 wrote to memory of 2592	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	33
PID 1396 wrote to memory of 2592	1396	{A024B3E6-1175-4d2e-B183-298974F63162}.exe	33
PID 2628 wrote to memory of 2396	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	34
PID 2628 wrote to memory of 2396	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	34
PID 2628 wrote to memory of 2396	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	34
PID 2628 wrote to memory of 2396	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	34
PID 2628 wrote to memory of 2436	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	35
PID 2628 wrote to memory of 2436	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	35
PID 2628 wrote to memory of 2436	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	35
PID 2628 wrote to memory of 2436	2628	{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe	35
PID 2396 wrote to memory of 2820	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	36
PID 2396 wrote to memory of 2820	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	36
PID 2396 wrote to memory of 2820	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	36
PID 2396 wrote to memory of 2820	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	36
PID 2396 wrote to memory of 576	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	37
PID 2396 wrote to memory of 576	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	37
PID 2396 wrote to memory of 576	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	37
PID 2396 wrote to memory of 576	2396	{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe	37
PID 2820 wrote to memory of 2372	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	38
PID 2820 wrote to memory of 2372	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	38
PID 2820 wrote to memory of 2372	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	38
PID 2820 wrote to memory of 2372	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	38
PID 2820 wrote to memory of 1852	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	39
PID 2820 wrote to memory of 1852	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	39
PID 2820 wrote to memory of 1852	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	39
PID 2820 wrote to memory of 1852	2820	{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe	39
PID 2372 wrote to memory of 1860	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	40
PID 2372 wrote to memory of 1860	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	40
PID 2372 wrote to memory of 1860	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	40
PID 2372 wrote to memory of 1860	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	40
PID 2372 wrote to memory of 2656	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	41
PID 2372 wrote to memory of 2656	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	41
PID 2372 wrote to memory of 2656	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	41
PID 2372 wrote to memory of 2656	2372	{10B5007E-4E0A-4674-9792-72B8586A116C}.exe	41
PID 1860 wrote to memory of 2024	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	42
PID 1860 wrote to memory of 2024	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	42
PID 1860 wrote to memory of 2024	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	42
PID 1860 wrote to memory of 2024	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	42
PID 1860 wrote to memory of 2012	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	43
PID 1860 wrote to memory of 2012	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	43
PID 1860 wrote to memory of 2012	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	43
PID 1860 wrote to memory of 2012	1860	{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe	43
PID 2024 wrote to memory of 2184	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	44
PID 2024 wrote to memory of 2184	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	44
PID 2024 wrote to memory of 2184	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	44
PID 2024 wrote to memory of 2184	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	44
PID 2024 wrote to memory of 2004	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	45
PID 2024 wrote to memory of 2004	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	45
PID 2024 wrote to memory of 2004	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	45
PID 2024 wrote to memory of 2004	2024	{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_8045184ac3be40b1d64b628d49dfbcc9_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\{A024B3E6-1175-4d2e-B183-298974F63162}.exe
  C:\Windows\{A024B3E6-1175-4d2e-B183-298974F63162}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
    C:\Windows\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
      C:\Windows\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
        
        C:\Windows\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2820
      - C:\Windows\{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
        
        C:\Windows\{10B5007E-4E0A-4674-9792-72B8586A116C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
        
        C:\Windows\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe
        
        C:\Windows\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
        
        C:\Windows\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
        
        C:\Windows\{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
        
        C:\Windows\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe
        
        C:\Windows\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe
        12⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70728~1.EXE > nul
        12⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0B17~1.EXE > nul
        11⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{312D1~1.EXE > nul
        10⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CEB2~1.EXE > nul
        9⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C1F3~1.EXE > nul
        8⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10B50~1.EXE > nul
        7⤵
        
        PID:2656
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE0BD~1.EXE > nul
        6⤵
        
        PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{28529~1.EXE > nul
        5⤵
        
        PID:576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BD2C4~1.EXE > nul
      4⤵
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A024B~1.EXE > nul
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{10B5007E-4E0A-4674-9792-72B8586A116C}.exe

Filesize
168KB

MD5
a131cac78c974666a7906b2ad652d1c9

SHA1
77315cf2ccda0024c61d28bb3a423a21251a233b

SHA256
89c1a434b73fe68605194c07011be4bf9cbf9fad9282e5f45e2900a30254af57

SHA512
db1e29ea28a5f3a53cc939e682f69c40ca9ab71cc1b8c2c3603c93bc395acb916dfce1044b74d5930d92832b66012592183c366a049292dbf960150d07c70130

Download Submit
C:\Windows\{285294DE-FD65-46d5-86E5-E4F8ED805C6F}.exe

Filesize
168KB

MD5
d241aa7a3c5ec8d1feb13926ce30cf0c

SHA1
f4d20e5781454162025d165c4f21ee147ccc0f71

SHA256
14efe899b3103a7ac7003b4776dbbe745f79c29da00b176962238c649bb1adff

SHA512
58769ced581d1d9524b3c3813b73dbf103fbbc9838de2ff76f63628986ec67ee556d3223da4f3bcb89e3561132a32669b02acbf20ea0768037f2110320b48d50

Download Submit
C:\Windows\{312D135C-E1A4-4a11-AA2C-30EA37F10B0A}.exe

Filesize
168KB

MD5
267e12081284223d5cdef52548968ef1

SHA1
360c15ebb03bff15825a0e3f627926d1ba198adf

SHA256
02d3c8f10ecbc3e7f5be8c54dff1c2a2429ebe1c8850baca90f2aadc9ec46318

SHA512
888ba50171d0db2dcde32b49514c31590c28dda9820b6a06386c05fe739597074b8844490cd7622fce794842369e99717bf38808e65bde95eb90831b189f68c2

Download Submit
C:\Windows\{559BAE60-EE27-44c1-8BFC-E6B6F33A1E8D}.exe

Filesize
168KB

MD5
1417becc582a63649ac39b504a898222

SHA1
73abe8b88c559f081a1a9447f6df2c0a171bc310

SHA256
d3a542e6e6e6c39c5457ba9a1bb94bd6df8370f30fd47f984946a4a97cc94330

SHA512
d228eae293181d9378d3ab70ef2bd9704929d5786536c2e9e527d6bd896022ea0cbf5e4262cc97fcb603f1c2473e021c39814cd3ca6131257078079281b6f0ba

Download Submit
C:\Windows\{6CEB2DB2-69BD-4fbd-9095-FE802D822296}.exe

Filesize
168KB

MD5
649884da5d50adf70870208c04c4e260

SHA1
88fd89f8bd0f8c521f24e0ad1e76fffc7d90da2f

SHA256
b60e97cea53d048f890ebec52fe32829e4aff8f37a2902779dd0283044650794

SHA512
b019ff526c0168ade1bd979416a13e5ba102681ad97e3fb615f5d2f2021a4e0d63055eb357496b65e293f88d91972c179147992d91b67e8ca817542180f3a47e

Download Submit
C:\Windows\{707281F7-CA07-4ebe-BBA6-2070BEC4FE62}.exe

Filesize
168KB

MD5
4bffad3038cb701f7d6e36406912f40a

SHA1
8dbdc04111dba0f7d55f1f3eeccfbcfdebccda1a

SHA256
adbc9f9c76bcf259581ec79935ba24262bc3943e10e1ccab0b16ae653c91ccda

SHA512
8981a64448eb921ec84cda2f66ed431fb93da79bacdceefd14f64d722a1c76006450507257bed6eee3a2d44477fa4fb58224335fe35fa3fd6d1e4a287397db76

Download Submit
C:\Windows\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe

Filesize
168KB

MD5
f6dacf45b97c3d0d98bfc74596da07c4

SHA1
2e56e8e45ccb79fad574d61a13d6b0a354d823d1

SHA256
765cc302734e2a1098d3f796b0af04a4bafcb4c8352f49cce9207b43834c85d3

SHA512
bce91d54b7a4724baf7de92c646140f266ddc4d53b050f1b514464e0ddb8f8422d67dfc6461a29b1c478b56042d06b9ba87bf8ed0d03db148b5f3fd72ea63c47

Download Submit
C:\Windows\{7C1F37F0-4878-4e68-9E12-66F3786728BD}.exe

Filesize
15KB

MD5
785191d6cdebd2c7be14602bd5a3ac6a

SHA1
afa1bc2161b563adbc8465cdfee2c834ec97494e

SHA256
f9fba624745aa66db1aee06feffb27dcfcd971ce6f43ce58bbc531489ceda702

SHA512
d37eac49dd84082c7ad8eabe97adc99cd463280c75b5ae79ceec704cb122c843710fad494fa1918d9f667af76a46bd4614453b122646a19648d43fa8133a6d37

Download Submit
C:\Windows\{A024B3E6-1175-4d2e-B183-298974F63162}.exe

Filesize
168KB

MD5
ba868c170eacfaed7f26b14269ad6495

SHA1
56cfd2fc5825af0f6994978ca204a2e0898a8e7e

SHA256
7330aeb8e19c25721292a0293cd4cdaa8e4f48eaa3b4773eae2701d254825193

SHA512
5f0752ee242f8c864c4f69814a612873b4eff0c10edb65fab5372118e61b2813c30cef6c61bed6791e71585003acdf71dc5c762d92b68f504f5873d5ea16ea97

Download Submit
C:\Windows\{AE0BD2BA-88C0-421a-9760-4412B90A5C57}.exe

Filesize
168KB

MD5
627b41d7216fe1877f0b671e11425054

SHA1
f2adf1379390d8e931fb51db73274edf392c5a41

SHA256
78f585dc96c36f7d608b6074e83945185b7d1748d7fd87b9f97b7f698d2469bf

SHA512
58eb59c47e0b27e9460466cc4bfbd021e1817d8f7fb5f6fd3d794eb9abd17a2e52afcaa553d014581c3ae6b4887cae53342f7972418c8d81be26bbad0171a2ce

Download Submit
C:\Windows\{B0B179B0-1748-4211-9A8F-D279D033A6FE}.exe

Filesize
168KB

MD5
a2e50d47e56f97d32fdd8f1a66fc2f2d

SHA1
19c3e58eaae53809958995ab2241211b0a2c0e3a

SHA256
b917a26c62c5bbc2b4c0f744d35a60b307fbbd7879f52ccd33c4ada0e796730c

SHA512
b80b3a505289715d065b2bbc98a59479964fac0645485999b69faad09a5a72df1dc1d68eec8972587d05ce0beeb0e8cce19f10ceec9b50d884a9e0a6ad7ff399

Download Submit
C:\Windows\{BD2C4C69-95FF-433d-ACC6-97C438F51A67}.exe

Filesize
168KB

MD5
aa40d6f4e180f25404d9ef54850f527d

SHA1
1fb5f05982e155fb0bced349f590fb7e00917eb9

SHA256
04055c1d8b23a2ec49da8b2aba1787c51a4bb83db64fb328aaf3b1ca32182c78

SHA512
8f0ad21fef937fbc0e7a392d2790fd7899166daa7532621cf27b9d15c5ce02cb1b43f8841540ff548ac170084d002d772bd444049b1150022d468348f813e7fb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads