0a42597fe072cfec5cf1f68fe37dab8e1a1f224e18f2dd7f90d03dae05c62ba3

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
Size

204KB
MD5

5327744f8cf9fcb5e8fc5b92e06fd90e
SHA1

d6b45ec7f11311cf7496b3dc808570bbb6e48d41
SHA256

0a42597fe072cfec5cf1f68fe37dab8e1a1f224e18f2dd7f90d03dae05c62ba3
SHA512

b3a79d85101beb70f353d3c3842eb77a5675c9f0354aa982ab0f222e07e42bf13a1f9d92958fef806347f291878e1695c9ede179a3e35bdb63a34176356786db
SSDEEP

1536:1EGh0oNl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oNl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000126f5-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014b34-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e0000000126f5-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f2-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f2-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f2-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D7F15B7-2080-439c-B428-511EBCD431A4}\stubpath = "C:\\Windows\\{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe"	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F518D587-4EA0-40e1-9287-28E19CE48AE6}	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF90527D-5285-401c-8B6B-80A88008049B}\stubpath = "C:\\Windows\\{AF90527D-5285-401c-8B6B-80A88008049B}.exe"	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}\stubpath = "C:\\Windows\\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe"	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}\stubpath = "C:\\Windows\\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe"	{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}	{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}	{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}\stubpath = "C:\\Windows\\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe"	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}\stubpath = "C:\\Windows\\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe"	{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}\stubpath = "C:\\Windows\\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe"	{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0B9F747-CACD-4588-953D-531E2CA45640}	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D7F15B7-2080-439c-B428-511EBCD431A4}	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F518D587-4EA0-40e1-9287-28E19CE48AE6}\stubpath = "C:\\Windows\\{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe"	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF90527D-5285-401c-8B6B-80A88008049B}	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E73B6806-C588-4e91-9E18-7058E38073B4}	{AF90527D-5285-401c-8B6B-80A88008049B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E73B6806-C588-4e91-9E18-7058E38073B4}\stubpath = "C:\\Windows\\{E73B6806-C588-4e91-9E18-7058E38073B4}.exe"	{AF90527D-5285-401c-8B6B-80A88008049B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E941DB4A-1228-414b-BA50-14A489714F3A}	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E941DB4A-1228-414b-BA50-14A489714F3A}\stubpath = "C:\\Windows\\{E941DB4A-1228-414b-BA50-14A489714F3A}.exe"	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}	{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0B9F747-CACD-4588-953D-531E2CA45640}\stubpath = "C:\\Windows\\{E0B9F747-CACD-4588-953D-531E2CA45640}.exe"	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe

Executes dropped EXE 11 IoCs

pid	Process
2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe
2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
2716	{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
1076	{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
2312	{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
1404	{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
File created	C:\Windows\{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
File created	C:\Windows\{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
File created	C:\Windows\{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
File created	C:\Windows\{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
File created	C:\Windows\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe	{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
File created	C:\Windows\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe	{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
File created	C:\Windows\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe	{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
File created	C:\Windows\{AF90527D-5285-401c-8B6B-80A88008049B}.exe	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
File created	C:\Windows\{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	{AF90527D-5285-401c-8B6B-80A88008049B}.exe
File created	C:\Windows\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
Token: SeIncBasePriorityPrivilege	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
Token: SeIncBasePriorityPrivilege	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
Token: SeIncBasePriorityPrivilege	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe
Token: SeIncBasePriorityPrivilege	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
Token: SeIncBasePriorityPrivilege	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
Token: SeIncBasePriorityPrivilege	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
Token: SeIncBasePriorityPrivilege	2716	{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
Token: SeIncBasePriorityPrivilege	1076	{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
Token: SeIncBasePriorityPrivilege	2312	{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2608	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	28
PID 3036 wrote to memory of 2608	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	28
PID 3036 wrote to memory of 2608	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	28
PID 3036 wrote to memory of 2608	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	28
PID 3036 wrote to memory of 3064	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	29
PID 3036 wrote to memory of 3064	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	29
PID 3036 wrote to memory of 3064	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	29
PID 3036 wrote to memory of 3064	3036	2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe	29
PID 2608 wrote to memory of 2576	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	30
PID 2608 wrote to memory of 2576	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	30
PID 2608 wrote to memory of 2576	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	30
PID 2608 wrote to memory of 2576	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	30
PID 2608 wrote to memory of 2684	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	31
PID 2608 wrote to memory of 2684	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	31
PID 2608 wrote to memory of 2684	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	31
PID 2608 wrote to memory of 2684	2608	{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe	31
PID 2576 wrote to memory of 2816	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	32
PID 2576 wrote to memory of 2816	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	32
PID 2576 wrote to memory of 2816	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	32
PID 2576 wrote to memory of 2816	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	32
PID 2576 wrote to memory of 2524	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	33
PID 2576 wrote to memory of 2524	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	33
PID 2576 wrote to memory of 2524	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	33
PID 2576 wrote to memory of 2524	2576	{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe	33
PID 2816 wrote to memory of 2936	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	36
PID 2816 wrote to memory of 2936	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	36
PID 2816 wrote to memory of 2936	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	36
PID 2816 wrote to memory of 2936	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	36
PID 2816 wrote to memory of 1568	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	37
PID 2816 wrote to memory of 1568	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	37
PID 2816 wrote to memory of 1568	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	37
PID 2816 wrote to memory of 1568	2816	{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe	37
PID 2936 wrote to memory of 2696	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	38
PID 2936 wrote to memory of 2696	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	38
PID 2936 wrote to memory of 2696	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	38
PID 2936 wrote to memory of 2696	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	38
PID 2936 wrote to memory of 2820	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	39
PID 2936 wrote to memory of 2820	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	39
PID 2936 wrote to memory of 2820	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	39
PID 2936 wrote to memory of 2820	2936	{AF90527D-5285-401c-8B6B-80A88008049B}.exe	39
PID 2696 wrote to memory of 1996	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	40
PID 2696 wrote to memory of 1996	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	40
PID 2696 wrote to memory of 1996	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	40
PID 2696 wrote to memory of 1996	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	40
PID 2696 wrote to memory of 1312	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	41
PID 2696 wrote to memory of 1312	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	41
PID 2696 wrote to memory of 1312	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	41
PID 2696 wrote to memory of 1312	2696	{E73B6806-C588-4e91-9E18-7058E38073B4}.exe	41
PID 1996 wrote to memory of 2324	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	42
PID 1996 wrote to memory of 2324	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	42
PID 1996 wrote to memory of 2324	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	42
PID 1996 wrote to memory of 2324	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	42
PID 1996 wrote to memory of 2492	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	43
PID 1996 wrote to memory of 2492	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	43
PID 1996 wrote to memory of 2492	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	43
PID 1996 wrote to memory of 2492	1996	{E941DB4A-1228-414b-BA50-14A489714F3A}.exe	43
PID 2324 wrote to memory of 2716	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	44
PID 2324 wrote to memory of 2716	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	44
PID 2324 wrote to memory of 2716	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	44
PID 2324 wrote to memory of 2716	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	44
PID 2324 wrote to memory of 2648	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	45
PID 2324 wrote to memory of 2648	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	45
PID 2324 wrote to memory of 2648	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	45
PID 2324 wrote to memory of 2648	2324	{E0B9F747-CACD-4588-953D-531E2CA45640}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_5327744f8cf9fcb5e8fc5b92e06fd90e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
  C:\Windows\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
    C:\Windows\{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
      C:\Windows\{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\{AF90527D-5285-401c-8B6B-80A88008049B}.exe
        
        C:\Windows\{AF90527D-5285-401c-8B6B-80A88008049B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
        
        C:\Windows\{E73B6806-C588-4e91-9E18-7058E38073B4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
        
        C:\Windows\{E941DB4A-1228-414b-BA50-14A489714F3A}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
        
        C:\Windows\{E0B9F747-CACD-4588-953D-531E2CA45640}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
        
        C:\Windows\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
        
        C:\Windows\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
        
        C:\Windows\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
        
        C:\Windows\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
        
        C:\Windows\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe
        
        C:\Windows\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe
        12⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F32EF~1.EXE > nul
        12⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9481~1.EXE > nul
        11⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C2C5E~1.EXE > nul
        10⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0B9F~1.EXE > nul
        9⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E941D~1.EXE > nul
        8⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E73B6~1.EXE > nul
        7⤵
        
        PID:1312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF905~1.EXE > nul
        6⤵
        
        PID:2820
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F518D~1.EXE > nul
        5⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5D7F1~1.EXE > nul
      4⤵
      PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{89127~1.EXE > nul
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{5D7F15B7-2080-439c-B428-511EBCD431A4}.exe

Filesize
204KB

MD5
372db3a889f3498fcb88fe7ec193f58a

SHA1
9dfec6a6c9c78ef25d9ac56e7e2aa158a1f51746

SHA256
d6c648a504af4566ff1bcd5b4ea8e1cb9df65514f273a74ffe9c045e6d0cc7a0

SHA512
8ab3086c5f594406405023616e03a98f7c9523aefacac21515ffed0fdd25d1bac7968e7537215949847a0d3296dd69a00cf88af04e9821eff003e918f912e6ec

Download Submit
C:\Windows\{89127790-35C1-41d5-8B5B-E14D3ACA7E89}.exe

Filesize
204KB

MD5
3bfe9cd81e0ace957b4ab0e23127d4ba

SHA1
aa9853719961af81bb35e053d0328747d219aaee

SHA256
6619a71d68186001ec4dc8e749180f23049c95eeda1c859289cc8bd50b0bc424

SHA512
20f1f18304ec1ee589b32c63040bf806a0ce0b4926ff796d450464d0947a76004bf367ac45acfb1c9cefae47910f682a035028662c0a898dfa6f301bee7907d7

Download Submit
C:\Windows\{AF90527D-5285-401c-8B6B-80A88008049B}.exe

Filesize
204KB

MD5
f258a86f2bf5cadbfb0b2c583ac7facc

SHA1
eac4e881ff0f8053ca8ab0729f0b03b8b99a7263

SHA256
d86f78be380e1dfe09f9a1910a6f8ac4f2b8b8cc5fa2a141e581257e7c5acf77

SHA512
e73065fc85a765e654a5b805944a31c5f31099df88d7dbae0d96b2f1eef827bc0ecb9e68b95f504882f6739a628c5d9a2802aa0f4ac21665ca854901cbbb0822

Download Submit
C:\Windows\{B4B7E7E8-4349-45c2-B6BF-723F69FC8211}.exe

Filesize
204KB

MD5
b5900d14d36951d4a0de2366623d2c78

SHA1
0a918c1f6f6e68c815afac88b3aa96908930eddb

SHA256
08880a9af8910004f9ba0156fef4278663764f10cf9c1d14c6174b7def661a44

SHA512
f3bb29966d8ac76170029fdc2f2772ee437531de5f50c48e81403f499200f1cf642a81621ab60460d6f051cc46964152ac46ea4cf4354bda8039443152288773

Download Submit
C:\Windows\{C2C5E5C9-F325-4ac9-88D7-0776A2F6B38B}.exe

Filesize
204KB

MD5
f99512d2b026934cb680fee23ce8984d

SHA1
a0e3225d9baac3906a2a9c93951fcbb22f96da97

SHA256
dcf974adfa264415be319a61486c4b421286c1a2146807694a0e18f18aec7f6e

SHA512
bb1f0ed040154bfe1ed340bcf1a97d1b7264471d8129bcbef8c19adc809c34d7bfdc6b85e3fc1706ce788500bcaef1cf2becc8bcc0ccc9aa4b3c69d3f8122339

Download Submit
C:\Windows\{D9481AFE-C597-44b0-95E4-AF0B03EAF796}.exe

Filesize
204KB

MD5
b65e1b0225a76b1da233732630492c42

SHA1
cbb156cb935c0dfb2b152193edecd89889d4121f

SHA256
6bdb763239f15a37713030d686e83ab620c675360d871c0fa86637ec338d2152

SHA512
110891277a4fcbda5ffc32563969ae9ff25317f1e786a1e3f1e1eb8fda739e734ce60399a38e297b4ea4b07295dcacf905d678fb5c1f78a4fa15d12f67ca21fd

Download Submit
C:\Windows\{E0B9F747-CACD-4588-953D-531E2CA45640}.exe

Filesize
204KB

MD5
7ab79e904e74cad81e24da668f3f21f1

SHA1
fb17b896e40149e387555b16438e208ea4524126

SHA256
1566bd03e96f7bce73c764c674a807c9d1ab3a4bdd37542c5f6fc034378d9d62

SHA512
7626bf9080b0149f45df9e46b87f37fc7f5a803c4f4356a9c42ab0371fd8cd5f18b06d64afed5c10669b0045724a5e0953a9f8953f2f00c99537e8c2b918ef7f

Download Submit
C:\Windows\{E73B6806-C588-4e91-9E18-7058E38073B4}.exe

Filesize
204KB

MD5
c6149980fff13f06d1714f321ffc7955

SHA1
15309904025f2a28de72a01dc9ff22bd7e59fdbf

SHA256
c5c4789385aa8cc826b058fe9940d7c2a181f0ef10c3249f625e785b0198d771

SHA512
2e2d142c0841fe9dc7142a32dc0f1e05d7bd019b051eba8f0bdc5830f40d0156533e146b278e670b86ad77b86b7bdf9c3cf678361511dac15f7a8b1d58a6e7e4

Download Submit
C:\Windows\{E941DB4A-1228-414b-BA50-14A489714F3A}.exe

Filesize
204KB

MD5
64478c4c5bfddf02617c02d9ca66dd46

SHA1
4bb3035d24c2a3f1781ff226e176941335654d2c

SHA256
f4e9c8d3af1ada0749c48c69bc3fdb615961a13c86a730f4e125c71b8053002b

SHA512
1ec8e92bc570a824301c8b7fb91923dc03d768f962c1f63cbf2c03cb62e4d34b9fd9e2113ee4fec49945d43104cbb164b00e0cc0704b3017262f4935008cb37c

Download Submit
C:\Windows\{F32EF853-730C-41fa-8CA4-35A50CFCDE3B}.exe

Filesize
204KB

MD5
9ed54b613bf8d52823afa06a1708ece1

SHA1
7c7b64a13d7316540c4886f9d0e20707ed374412

SHA256
534b0643e0d42e8279f2b96fcd41a943b8ae64dd42b1964fde7fc950d61d6e61

SHA512
88c65cd600cdf16ad42febf7989fabe975b27419c92c99e743b1e59697820a3cae31ee33c667a02c5fd2129d312718ae7530713ab8fcdba1f57e928be8f935f6

Download Submit
C:\Windows\{F518D587-4EA0-40e1-9287-28E19CE48AE6}.exe

Filesize
204KB

MD5
cb647f8015791f2ec5ebc4b3321de9ea

SHA1
32224f752ccac5c8a920048ae806b8d8c89b037c

SHA256
d83544b457a26167518b3dcb505e4e52c937ff4c685460157a2355bff60350e4

SHA512
93227daa3c06d6d4dcf778f86672dc20a0d8e7a98f8d543300a517e4c25ad0554ca6e876326be22e612d00830947891200a83028ad2c64ba18ef86c517e30be0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads