8c61e8ae8c18fcd3a58ef0db0fc5986d0dd10c842e8755ee531c4e36d9a7d72c

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
Size

344KB
MD5

668db7933060c64e5efee9760409218c
SHA1

41f66c43dd8efc9d36bb18a1a9fb0b63273e0e02
SHA256

8c61e8ae8c18fcd3a58ef0db0fc5986d0dd10c842e8755ee531c4e36d9a7d72c
SHA512

0736241a55e3356aaf5034a7da3e98bd4b1047ff66c861b14c8623be3b2b613fb8871d515cda319eed64da7a1a672e6496fc53f14cc92ad0734bc20436900903
SSDEEP

3072:mEGh0oslEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGilqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 16 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014abe-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000014abe-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014b31-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000014abe-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014abe-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014b31-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000155f7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014abe-20.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000155f7-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014abe-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014abe-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000014abe-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000014abe-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D239A48-45FC-449a-9BF2-587AC8D499A2}\stubpath = "C:\\Windows\\{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe"	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}\stubpath = "C:\\Windows\\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe"	{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23144C20-CC37-4578-8B46-B101BB95F58C}\stubpath = "C:\\Windows\\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe"	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6EC9C18-7FDA-497b-A22A-A65091289D69}\stubpath = "C:\\Windows\\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe"	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}	{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}\stubpath = "C:\\Windows\\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe"	{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}	{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}\stubpath = "C:\\Windows\\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe"	{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}	{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}\stubpath = "C:\\Windows\\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe"	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}\stubpath = "C:\\Windows\\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe"	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}\stubpath = "C:\\Windows\\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe"	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23144C20-CC37-4578-8B46-B101BB95F58C}	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6EC9C18-7FDA-497b-A22A-A65091289D69}	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D239A48-45FC-449a-9BF2-587AC8D499A2}	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}\stubpath = "C:\\Windows\\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe"	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}\stubpath = "C:\\Windows\\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe"	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe

Deletes itself 1 IoCs

pid	Process
3044	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
500	{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
2152	{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
1704	{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe
584	{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
File created	C:\Windows\{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
File created	C:\Windows\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
File created	C:\Windows\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
File created	C:\Windows\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
File created	C:\Windows\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe	{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
File created	C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
File created	C:\Windows\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
File created	C:\Windows\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
File created	C:\Windows\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe	{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
File created	C:\Windows\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe	{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
Token: SeIncBasePriorityPrivilege	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
Token: SeIncBasePriorityPrivilege	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
Token: SeIncBasePriorityPrivilege	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
Token: SeIncBasePriorityPrivilege	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
Token: SeIncBasePriorityPrivilege	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
Token: SeIncBasePriorityPrivilege	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
Token: SeIncBasePriorityPrivilege	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
Token: SeIncBasePriorityPrivilege	500	{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
Token: SeIncBasePriorityPrivilege	2152	{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
Token: SeIncBasePriorityPrivilege	1704	{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 632	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	28
PID 1108 wrote to memory of 632	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	28
PID 1108 wrote to memory of 632	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	28
PID 1108 wrote to memory of 632	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	28
PID 1108 wrote to memory of 3044	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	29
PID 1108 wrote to memory of 3044	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	29
PID 1108 wrote to memory of 3044	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	29
PID 1108 wrote to memory of 3044	1108	2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe	29
PID 632 wrote to memory of 2640	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	30
PID 632 wrote to memory of 2640	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	30
PID 632 wrote to memory of 2640	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	30
PID 632 wrote to memory of 2640	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	30
PID 632 wrote to memory of 2680	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	31
PID 632 wrote to memory of 2680	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	31
PID 632 wrote to memory of 2680	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	31
PID 632 wrote to memory of 2680	632	{23144C20-CC37-4578-8B46-B101BB95F58C}.exe	31
PID 2640 wrote to memory of 2568	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	32
PID 2640 wrote to memory of 2568	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	32
PID 2640 wrote to memory of 2568	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	32
PID 2640 wrote to memory of 2568	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	32
PID 2640 wrote to memory of 2484	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	33
PID 2640 wrote to memory of 2484	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	33
PID 2640 wrote to memory of 2484	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	33
PID 2640 wrote to memory of 2484	2640	{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe	33
PID 2568 wrote to memory of 1936	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	36
PID 2568 wrote to memory of 1936	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	36
PID 2568 wrote to memory of 1936	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	36
PID 2568 wrote to memory of 1936	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	36
PID 2568 wrote to memory of 2932	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	37
PID 2568 wrote to memory of 2932	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	37
PID 2568 wrote to memory of 2932	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	37
PID 2568 wrote to memory of 2932	2568	{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe	37
PID 1936 wrote to memory of 2396	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	38
PID 1936 wrote to memory of 2396	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	38
PID 1936 wrote to memory of 2396	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	38
PID 1936 wrote to memory of 2396	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	38
PID 1936 wrote to memory of 2784	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	39
PID 1936 wrote to memory of 2784	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	39
PID 1936 wrote to memory of 2784	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	39
PID 1936 wrote to memory of 2784	1936	{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe	39
PID 2396 wrote to memory of 1768	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	40
PID 2396 wrote to memory of 1768	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	40
PID 2396 wrote to memory of 1768	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	40
PID 2396 wrote to memory of 1768	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	40
PID 2396 wrote to memory of 1788	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	41
PID 2396 wrote to memory of 1788	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	41
PID 2396 wrote to memory of 1788	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	41
PID 2396 wrote to memory of 1788	2396	{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe	41
PID 1768 wrote to memory of 2736	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	42
PID 1768 wrote to memory of 2736	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	42
PID 1768 wrote to memory of 2736	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	42
PID 1768 wrote to memory of 2736	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	42
PID 1768 wrote to memory of 2780	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	43
PID 1768 wrote to memory of 2780	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	43
PID 1768 wrote to memory of 2780	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	43
PID 1768 wrote to memory of 2780	1768	{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe	43
PID 2736 wrote to memory of 500	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	44
PID 2736 wrote to memory of 500	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	44
PID 2736 wrote to memory of 500	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	44
PID 2736 wrote to memory of 500	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	44
PID 2736 wrote to memory of 960	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	45
PID 2736 wrote to memory of 960	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	45
PID 2736 wrote to memory of 960	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	45
PID 2736 wrote to memory of 960	2736	{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_668db7933060c64e5efee9760409218c_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
  C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
    C:\Windows\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
      C:\Windows\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
        
        C:\Windows\{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
        
        C:\Windows\{69FECA1C-6A49-49c4-BA9A-24428BE685D8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
        
        C:\Windows\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
        
        C:\Windows\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
        
        C:\Windows\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:500
        
        C:\Windows\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
        
        C:\Windows\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Windows\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe
        
        C:\Windows\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe
        
        C:\Windows\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe
        12⤵
        Executes dropped EXE
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF73E~1.EXE > nul
        12⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FE2B~1.EXE > nul
        11⤵
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F0C88~1.EXE > nul
        10⤵
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0AEAF~1.EXE > nul
        9⤵
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9AB52~1.EXE > nul
        8⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{69FEC~1.EXE > nul
        7⤵
        
        PID:1788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D239~1.EXE > nul
        6⤵
        
        PID:2784
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6EC9~1.EXE > nul
        5⤵
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{39320~1.EXE > nul
      4⤵
      PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{23144~1.EXE > nul
    3⤵
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0AEAFABF-5C87-432a-97F2-9E871363F7FC}.exe

Filesize
344KB

MD5
c6a3a536282e02ad64d95d5989483901

SHA1
a88eddd6f6fd67af0d2a4e1d42a482f6a18f3e90

SHA256
d2c6e4b813cf2c551806ac8f2ac8dfa3687c3e98047b3b4e2b28d082e6ac35f9

SHA512
d358447f55e59d6d760c578b521a2cff78de60247ec9c72f3ebb1aba1e7113e8d4b152186d7bf6791ecc50cd23688e0219a70e1820cd8a013ebaaf22883a5939

Download Submit
C:\Windows\{1D239A48-45FC-449a-9BF2-587AC8D499A2}.exe

Filesize
1KB

MD5
0469c37c06779c374b10516f746e54cd

SHA1
a554cdfb5bfe2fdbef5626dff44175a0a14c9aa7

SHA256
42a50b9c0cdee18b6513ca0684fe36d5108fee23b4202466ba22f5312f2c43b5

SHA512
8116e597ca3fc7d7b801424a1b37533ade4fbe62b33f7045e6eaeb6b03275c7e981498b4e237230262e157aed9d257faadb6ba1586191f0ebb8d87f292cf4ce0

Download Submit
C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe

Filesize
218KB

MD5
177f38501f04e4a35a725a53e6a34494

SHA1
676c85f7e29f315c06abbc21f17311e1d91efce5

SHA256
21721f51f61b127acbe864d2302aeacb767ea8ebf0e17629357c3ef518e3ba86

SHA512
0e9a492acdb1e0e52f58efb21ced9dad788bdc46c69b503d4a0f98741f613140242bd42abd33baac78f009614c3e364b9297446290c289f56cf0730f2b21db9f

Download Submit
C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe

Filesize
253KB

MD5
a75424ef008cff073a58f2cfbc419cb3

SHA1
4bcad54b7f5797cdecab871d54f44f2c216ade43

SHA256
7ed376de2501e1f2cc3636bd0b2ffb208e2bfccf3ae5c7101daf6cb2a5d03b59

SHA512
a8ff3749db6fe755551b9862bb8bc852860fd36396072d62d3631a5005cec4745d6756262095a984c344592385e9cc70c7ff5dac89edba3b82ef2837ea478e97

Download Submit
C:\Windows\{23144C20-CC37-4578-8B46-B101BB95F58C}.exe

Filesize
158KB

MD5
02e8c1d79da546832ff6adbfe2dbde72

SHA1
7f4ba656dbfd2424e31e6edf882e153d5f100793

SHA256
8b1b0ecb81117975a2066b0428c03446db4b3862c8f3de4b884c475d33350700

SHA512
4e2e59a506e15ceb0694ba9a0ebd06cfc4701840c9fbb8d5366a8fda06fd0cf1e3f5c8600a351bd4c9288acdfc639b39c9a202a313085891fa0230e7fdf6c0d0

Download Submit
C:\Windows\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe

Filesize
172KB

MD5
bc033d9e0b81ca92fb904f053facd9c3

SHA1
666a5c2bbfe3abe6109d85579d5aa39915731e8a

SHA256
758dd47520e3eb2a714412a889c249e51c1ef9b29f583eb2fdf3d1977a4d593b

SHA512
54faa754c5dbfb70acef7b03b22b5a21e9567b2a20c79db59ee8165c1e48021d41a9db091bcef2d35bb91a11a1014dcdb91efa7c03ed4ae583ae5bac54b5380d

Download Submit
C:\Windows\{39320911-33FE-4c15-8ACA-5D9C3553FDB7}.exe

Filesize
7KB

MD5
9925f18afc56a50168bd04baec52e84f

SHA1
d054913ef647dc17c7f914c77ac38a31ba0957fb

SHA256
c12ad4de88bb8f0ea780e06c95aff08375452725d30d1169a841249ffcc06595

SHA512
435125501c850785fa6e267b414388d83c5277cc3939dcfd82067df6b3341b7fcea0269b893ba20222a710896789f4bc37812d1dd57311dbd404151517b3b1c9

Download Submit
C:\Windows\{7FE2B27C-BC31-4d1f-9336-6243DB9044EF}.exe

Filesize
344KB

MD5
173c0f59e04ae964bc45c5ebb83906af

SHA1
29870b65d98ded450ded13b23f9690456e4e5022

SHA256
5c6cedecad67d6da95e2e6d37b17826a9aa7c3a0d6f614a6f711914de324e8a7

SHA512
378b5aa7aed3cd9758b360fb143c69409fc0e81f64d1fa0515015a5b8582355526696d85987ce0fbb3ebf07d69eca713e76330818e8c852b755ecd18eb0e3605

Download Submit
C:\Windows\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe

Filesize
25KB

MD5
3c71ebdf5da7994b4111b500103777fa

SHA1
a63a08aaff1cbf97f45b997abc0c776c6f5d77d0

SHA256
0dd7f78088f5fa39c8df2ff6b1dc8849410ba6cb0b89ae6da780b58dcab65a68

SHA512
2979a702c50f60d8679672229d0b9e7abb03f76fc486d688e1088a101d3fd69a2e5bef30e178afaeb70ce966387087f2e18ba5e2517bb48f76a7f7144d669d95

Download Submit
C:\Windows\{9AB5220A-88FF-4932-9B46-ADDED39A5AA0}.exe

Filesize
344KB

MD5
8fed22386879d3fa3b8d5e8bcf35fa14

SHA1
a33e87f7eb3c1baa13d73cace0655d47677c75fb

SHA256
73ba951b9cf25b5d85cd60cde9056b1bb1a4de6a7b2ab0fdf5919057d9f1d26a

SHA512
ad24ae2e4dde9f01da0fb23e3400ec8391d7ee4899ead4884b0984384d63c88750a8f62d06643e003875be951ce0a084cf7905e8210c7f2b02f671b919d21659

Download Submit
C:\Windows\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe

Filesize
344KB

MD5
cb71c6434a2a61d65a6dc70fcbc82872

SHA1
e8f64f6e93878de416b406dceeb2723b5a4c7a48

SHA256
0c35f1ded6f1cc77c5f7d1e2a16cda3d3d5878047cedb7cfea8c741bc4b129aa

SHA512
8c4f27ff440d28e8b31fb5e7b4e3fbf40d6fd8a8b50d6aab7ef163b5d556568e38142bbdccac79e983c81b65c0663d00fffc27c37ca710ecb1ac1494b09129e6

Download Submit
C:\Windows\{A6EC9C18-7FDA-497b-A22A-A65091289D69}.exe

Filesize
24KB

MD5
d0e2b50880bf10af0bdc31b2b0fb64fb

SHA1
a7930cd2aba39d2e52b4e127c810408cfe8309c4

SHA256
d18e297c3c3156bddee4da6f79e2042ef26bff598b59921a99185f9d81d6a853

SHA512
003da8549dbbb457009cd334eca269882e9a2f395ee323e1e9989e7a4c526ba81a59184eaf83e0f032a22c23ec78259001a0ba1686a65c8ae4b57e5f601742c4

Download Submit
C:\Windows\{F0C8824E-FF60-4d52-A31B-D41D08C19B4F}.exe

Filesize
344KB

MD5
2400039aa68fd3592419f725686858ef

SHA1
746e3294cd5cacf81a59c3863d393accca7d2427

SHA256
90b758cc2caf29f6d619bc8b2cb25d1853926d882f4f0c1ae74cf10001a65f40

SHA512
cf81742dbf48c53315d34352762f772fd96a6e22accbb2f6baf24e89c8ea024a6ff31dfae05d00c900f7e3d5db7510e21221753a4fa34f16987bac885bf42d70

Download Submit
C:\Windows\{FD1BB5B9-55AF-4777-BAC6-97E7F242FBF1}.exe

Filesize
344KB

MD5
8bfb587c0e20a8ea5fa74d4642e918ab

SHA1
94679ebc414fe1738d80b769300f7ee9ed58e79d

SHA256
c92b3df80dcacc586172920eba7f1e251c3e7ddebf97c0e02bb2787879dd8d01

SHA512
70aa169532309c17bd23b00163d44d66cf74794fe8260e183e577ed046813a08efa4fc960f2c53fdfa0e9ee7c68ea2de6a7cb5e1428a8573366e4fb3555b50e9

Download Submit
C:\Windows\{FF73E314-7A64-4f06-A436-0CD9E46FB88E}.exe

Filesize
344KB

MD5
7d1ac93ba18fed83a84a2da48175e552

SHA1
4c1f5a9749e0fa880853c4af86f189dafac3745c

SHA256
d8d9c9fdd1c76a18ea09748b3726a62321ed9dc1d5d41aca0684064e31144140

SHA512
6085474e285e7f8b5c3734864543ab07640702b3479f6cdb8c283df6ef1e457be0e4fd93fc6045e873fc81da8c416ea8126cd6dd61a66eca0b8de1adde9969ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads