3c1adf7c9d36d074403ca088bff8bcb2f446291f68b58c37dde47cd94aa8a818

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
Size

372KB
MD5

3bd9098534fdb10761ecea97b2da5968
SHA1

b68349b58c12301a5191bdc71e002ab59a69f34c
SHA256

3c1adf7c9d36d074403ca088bff8bcb2f446291f68b58c37dde47cd94aa8a818
SHA512

a253119f247dd436dac033f0ba3b6aa9d6efabe3b70827a50acb649dd6c469ce138e615cfdafd2c1b89d2ec16a2e79d42011c9a82449243f15569e2e7e620adb
SSDEEP

3072:CEGh0oYlMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGalkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 13 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122f2-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122f2-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122f2-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015598-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015c3d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c3d-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015c3d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015c3d-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015c45-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015c3d-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{420255D7-9442-4a67-A23A-BA897CD0DCA7}\stubpath = "C:\\Windows\\{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe"	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}\stubpath = "C:\\Windows\\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe"	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49709FF7-E921-4c00-A62C-5068B4EBF498}	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B80EFDDD-6329-4883-A455-D93512F04833}\stubpath = "C:\\Windows\\{B80EFDDD-6329-4883-A455-D93512F04833}.exe"	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{420255D7-9442-4a67-A23A-BA897CD0DCA7}	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{49709FF7-E921-4c00-A62C-5068B4EBF498}\stubpath = "C:\\Windows\\{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe"	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}\stubpath = "C:\\Windows\\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe"	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4209BA0-073E-4b09-83EB-D7C67704276E}	{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4209BA0-073E-4b09-83EB-D7C67704276E}\stubpath = "C:\\Windows\\{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe"	{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}\stubpath = "C:\\Windows\\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe"	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7BEECCE-FED5-4819-B986-B1D6A760B624}\stubpath = "C:\\Windows\\{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe"	{B80EFDDD-6329-4883-A455-D93512F04833}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB4D48F5-5130-45d5-AC60-FD8727894A44}\stubpath = "C:\\Windows\\{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe"	{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}\stubpath = "C:\\Windows\\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe"	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB4D48F5-5130-45d5-AC60-FD8727894A44}	{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A7BEECCE-FED5-4819-B986-B1D6A760B624}	{B80EFDDD-6329-4883-A455-D93512F04833}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A25F326F-2307-4563-8C97-2F1327EEA31A}	{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A25F326F-2307-4563-8C97-2F1327EEA31A}\stubpath = "C:\\Windows\\{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe"	{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B80EFDDD-6329-4883-A455-D93512F04833}	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe

Deletes itself 1 IoCs

pid	Process
1996	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe
2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
1956	{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
1500	{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
2140	{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
2916	{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	{B80EFDDD-6329-4883-A455-D93512F04833}.exe
File created	C:\Windows\{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
File created	C:\Windows\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
File created	C:\Windows\{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe	{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
File created	C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
File created	C:\Windows\{B80EFDDD-6329-4883-A455-D93512F04833}.exe	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
File created	C:\Windows\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
File created	C:\Windows\{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe	{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
File created	C:\Windows\{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe	{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
File created	C:\Windows\{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
File created	C:\Windows\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
Token: SeIncBasePriorityPrivilege	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe
Token: SeIncBasePriorityPrivilege	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
Token: SeIncBasePriorityPrivilege	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
Token: SeIncBasePriorityPrivilege	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
Token: SeIncBasePriorityPrivilege	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
Token: SeIncBasePriorityPrivilege	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
Token: SeIncBasePriorityPrivilege	1956	{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
Token: SeIncBasePriorityPrivilege	1500	{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
Token: SeIncBasePriorityPrivilege	2140	{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2504	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	28
PID 2300 wrote to memory of 2504	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	28
PID 2300 wrote to memory of 2504	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	28
PID 2300 wrote to memory of 2504	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	28
PID 2300 wrote to memory of 1996	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	29
PID 2300 wrote to memory of 1996	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	29
PID 2300 wrote to memory of 1996	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	29
PID 2300 wrote to memory of 1996	2300	2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe	29
PID 2504 wrote to memory of 2624	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	30
PID 2504 wrote to memory of 2624	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	30
PID 2504 wrote to memory of 2624	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	30
PID 2504 wrote to memory of 2624	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	30
PID 2504 wrote to memory of 2732	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	31
PID 2504 wrote to memory of 2732	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	31
PID 2504 wrote to memory of 2732	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	31
PID 2504 wrote to memory of 2732	2504	{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe	31
PID 2624 wrote to memory of 2556	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	32
PID 2624 wrote to memory of 2556	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	32
PID 2624 wrote to memory of 2556	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	32
PID 2624 wrote to memory of 2556	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	32
PID 2624 wrote to memory of 2540	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	33
PID 2624 wrote to memory of 2540	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	33
PID 2624 wrote to memory of 2540	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	33
PID 2624 wrote to memory of 2540	2624	{B80EFDDD-6329-4883-A455-D93512F04833}.exe	33
PID 2556 wrote to memory of 2496	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	36
PID 2556 wrote to memory of 2496	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	36
PID 2556 wrote to memory of 2496	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	36
PID 2556 wrote to memory of 2496	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	36
PID 2556 wrote to memory of 2924	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	37
PID 2556 wrote to memory of 2924	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	37
PID 2556 wrote to memory of 2924	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	37
PID 2556 wrote to memory of 2924	2556	{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe	37
PID 2496 wrote to memory of 2492	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	38
PID 2496 wrote to memory of 2492	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	38
PID 2496 wrote to memory of 2492	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	38
PID 2496 wrote to memory of 2492	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	38
PID 2496 wrote to memory of 1968	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	39
PID 2496 wrote to memory of 1968	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	39
PID 2496 wrote to memory of 1968	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	39
PID 2496 wrote to memory of 1968	2496	{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe	39
PID 2492 wrote to memory of 484	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	40
PID 2492 wrote to memory of 484	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	40
PID 2492 wrote to memory of 484	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	40
PID 2492 wrote to memory of 484	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	40
PID 2492 wrote to memory of 2340	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	41
PID 2492 wrote to memory of 2340	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	41
PID 2492 wrote to memory of 2340	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	41
PID 2492 wrote to memory of 2340	2492	{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe	41
PID 484 wrote to memory of 676	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	42
PID 484 wrote to memory of 676	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	42
PID 484 wrote to memory of 676	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	42
PID 484 wrote to memory of 676	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	42
PID 484 wrote to memory of 444	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	43
PID 484 wrote to memory of 444	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	43
PID 484 wrote to memory of 444	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	43
PID 484 wrote to memory of 444	484	{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe	43
PID 676 wrote to memory of 1956	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	44
PID 676 wrote to memory of 1956	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	44
PID 676 wrote to memory of 1956	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	44
PID 676 wrote to memory of 1956	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	44
PID 676 wrote to memory of 564	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	45
PID 676 wrote to memory of 564	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	45
PID 676 wrote to memory of 564	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	45
PID 676 wrote to memory of 564	676	{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_3bd9098534fdb10761ecea97b2da5968_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
  C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\{B80EFDDD-6329-4883-A455-D93512F04833}.exe
    C:\Windows\{B80EFDDD-6329-4883-A455-D93512F04833}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
      C:\Windows\{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
        
        C:\Windows\{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
      - C:\Windows\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
        
        C:\Windows\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
        
        C:\Windows\{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:484
        
        C:\Windows\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
        
        C:\Windows\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
        
        C:\Windows\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Windows\{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
        
        C:\Windows\{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
        
        C:\Windows\{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe
        
        C:\Windows\{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe
        12⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BB4D4~1.EXE > nul
        12⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4209~1.EXE > nul
        11⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1E627~1.EXE > nul
        10⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{43D9D~1.EXE > nul
        9⤵
        
        PID:564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49709~1.EXE > nul
        8⤵
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13897~1.EXE > nul
        7⤵
        
        PID:2340
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{42025~1.EXE > nul
        6⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A7BEE~1.EXE > nul
        5⤵
        
        PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B80EF~1.EXE > nul
      4⤵
      PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{60BC0~1.EXE > nul
    3⤵
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{138970E6-BC30-45b9-B4C3-C9108D80CBBC}.exe

Filesize
372KB

MD5
f6744bd1fedd90a0a7ee9849470f4a0f

SHA1
0896360a05136308340753ca5ade6bfb0bb83d6b

SHA256
b976fdc90b78e2d9954bcda11765a6aa5eb8fbecaba7999f318997842caf408a

SHA512
4c4c95708c1f3aea5281fac87d74658b3636dda334af72e4dac79f5e817c621d04b19917dad4ea96a0299483fc9e33871b424c307b731287d939dc7a5320256d

Download Submit
C:\Windows\{1E627E0E-307B-4b55-AAB6-4A7007344BE9}.exe

Filesize
372KB

MD5
0c105e45f525d4977ca76f28ea189941

SHA1
29603e98a9249ab68656e070b882cdaee1f2d07f

SHA256
464c3668f847a62ae1f279bbbf7ff576295cf7b92e61c1bb35bc9bc9972dabe1

SHA512
45164275c7900211bf1b30c09b19a0349a93d107fd9fa39d23d2913e3b4cf09dd829413930c7204ca0eede4f3154f74b32b51cccb3a4c44b93447b1542de1ad9

Download Submit
C:\Windows\{420255D7-9442-4a67-A23A-BA897CD0DCA7}.exe

Filesize
372KB

MD5
5b7abae453f97750c2c6b0e26540cd75

SHA1
3180e9ea93515dec37228fb9fc8f53143a381009

SHA256
96bac2346a8faf6bcba2689fb893a7afa4c3c24e5705a7c3619cfdce0971b60f

SHA512
0a45e121acbdee5ff0c571097527cdff505821d6b6792f33336ee613191681d9b88a7a105a7114feea8a9f9b50ef3efe9c5b0c50a18c14a410d6becc500b38ab

Download Submit
C:\Windows\{43D9D7EE-48F7-4df3-8C96-7A3E92E0710A}.exe

Filesize
372KB

MD5
61af4ceb14635e6dcbfca2e4d7749c20

SHA1
ab9f6ea5db02c48101070ff1a855ce0a2bde9952

SHA256
5b59932cd55d5b66db956901b0adfc6aa8d4bf326cdc627e50dd94fe6370cc0d

SHA512
52be17a8c96b23bfbbcb77bf8de8ed294b6b2b8d85949f01e8270dcf44bce48b0879b39ed15e45184c6fdfe80643b8d14e5a74eb5243496d777f9d0b5802dabf

Download Submit
C:\Windows\{49709FF7-E921-4c00-A62C-5068B4EBF498}.exe

Filesize
372KB

MD5
8a02bafd5dbfeb5fb0d482dafcfc476a

SHA1
8882b131fda920d45f2408f1b341dcaa0b6ca9de

SHA256
09fb08674c33c8d0f0dbd2bf5fe7958fe29b877456a1a238248d80bf844d63f2

SHA512
5429da0fa3f9983e98350f6c17eb7b3657b6fe1aed52756c5b543f98f8d2d3057baec24e15d9eb6e5b3a84e7796b23dbb5722c942a90a8a2f691165c4738a625

Download Submit
C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe

Filesize
368KB

MD5
000a53c40af583288f0f58e914db37d8

SHA1
006321ea9d26801b04b1eed0c026ff0b1379dd13

SHA256
b259e43aed22a6856bb8234b9cdf5e9f32a38061db060413b72a7356a614c503

SHA512
0113c9b6f0916a57b68693b25102fae9463f965ed8068e606bd2f7414fcbab7259daf0715438f62f72033155590707993d58957286d51df2df54e5b5605dda89

Download Submit
C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe

Filesize
300KB

MD5
d56bb6b1e2e05229aa7150d86ce37587

SHA1
636aaa08347180c5d63030816daf1a3c12e03227

SHA256
174eb37a582b848b67790c6ff4fa4137ac4ff1638775ebc25f55aa5e7c00bafe

SHA512
2dc4c0a899e364cbc24968b9ba0d092874f5967d69bca4230e98d695e57ffff8e0334180a076eaeac51f5b1d680b2f1a4a787b38a945a327d5de1d777b3d81c5

Download Submit
C:\Windows\{60BC0436-8EDC-4f08-9664-DCF6FE0A0DC1}.exe

Filesize
372KB

MD5
9b761c7e800b781d239a9aee0bd682eb

SHA1
a102aa64bf68a1d25226710d44d4f5be02852cc7

SHA256
d0c22227aafe4502dba313233b0ee811c84f3b3aebc90f2ecbfe1dbe9ff5efcb

SHA512
49f1d5b28bc3014002befd61ba669531beb0d5a7a5188cc174fdf3a9883cea8f285db0e4286ee08a062a53d9ad517b54256088c646e550b92e203f172dc4eebc

Download Submit
C:\Windows\{A25F326F-2307-4563-8C97-2F1327EEA31A}.exe

Filesize
372KB

MD5
8c2db5a89cc7568c03c1729d24a4ea62

SHA1
733b32e639e67e9a5a8e2e5e0ef1b6ad3676615f

SHA256
83754dd2aabdc0a90599a90391f567f96ac4594cf98d1d32d26df2533cf9b4c0

SHA512
21f1b9140c64875ae5a17c85b1e41f4791aab3fb5aa5a005e4b01475a84ad17270636c39bdcf9426a3cacad933835ceb0adbed134f3c8d0d9af9f5f49d17a191

Download Submit
C:\Windows\{A7BEECCE-FED5-4819-B986-B1D6A760B624}.exe

Filesize
372KB

MD5
a8a0e3b9f11093270615eb6ee688bc4a

SHA1
2de6814c48437f3efff46f670ad5c835719ef295

SHA256
28bf83ff1c2dadae993c1c57995bac11b6d984fd16d44ce93b8ed1be1af4b85e

SHA512
ee4b0b15534568883a3441315776c10489baa7b8a36d7940285e41cf5f008357aff55f3fa71396f5405c17be572aed51b9c2693b3259b1c02a921ec2f033d5bc

Download Submit
C:\Windows\{B80EFDDD-6329-4883-A455-D93512F04833}.exe

Filesize
372KB

MD5
b04c5198640a6318bd250afd759a9ee7

SHA1
daa627de6c46e70bcb676298feeb5136d9c7cef7

SHA256
7af56b1d7e28424658fa13320ae2ebd8b1b6b06e5d01ef3e6c3aaba2fb6dac95

SHA512
0ac576327f3b98140c08bc883a0ee63ad4d12429f34a215c2a5f2bd6eb3d31e012833bca91585cdd99d6d31e1b53bf9775491a03065ba1296a4872db80de8af9

Download Submit
C:\Windows\{BB4D48F5-5130-45d5-AC60-FD8727894A44}.exe

Filesize
372KB

MD5
2bdc632d4238e1c2377570205695d2db

SHA1
9585897ff245cb657aabf3bd03fbfaa41849bce5

SHA256
e713795bb687dce7fa7edce2e85ba1296e5bf74008e317ef8a242d12a35804b9

SHA512
b0eeecd8d0f2d2cd4e28efa27b9b884e72d5b4ad2e190613cea50418aec6fee95e609cdf497525f240aa049f8cb70dafd6628c1d49bb3b7882b2fbb3d2504d1e

Download Submit
C:\Windows\{E4209BA0-073E-4b09-83EB-D7C67704276E}.exe

Filesize
372KB

MD5
eb079c8845762681eff0d7ec479d298e

SHA1
2312599bca00ddf5ab4d922cc0d92a8371760747

SHA256
60d39cc65a46338d0b1bf6ff8a9dd0a3b14c781c763335711ec03eddccfabb54

SHA512
94410a109add3961db463c41c0d8790f80d722506247f00535b9e769c7becf7524031e639b170bbb7243a77a1df17b15edd30ed6bf344da58434f1cfe1e00016

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads