59fe019f0c6741b09bd88bb33b1fae93c7a49bb20652ab79a431d06d6c22c70a

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Size

372KB
MD5

39fc6a37b1b3a7574cbf8d757353b255
SHA1

52c8610784a3c7a649a3da285bd506843d1747e1
SHA256

59fe019f0c6741b09bd88bb33b1fae93c7a49bb20652ab79a431d06d6c22c70a
SHA512

58c03076fbdcb0e64939c97be7edcb48984ac82c56924680cdd947a06094b5107d494d85a2373dec9f68e29d7659393dfa992b3f896acd6babeb2ef4206c0ea7
SSDEEP

3072:CEGh0oLmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGcl/Oe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012331-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012251-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0032000000013a88-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012251-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012251-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012251-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}\stubpath = "C:\\Windows\\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe"	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{491FA3FC-379F-451c-A6A4-94E9291C0310}\stubpath = "C:\\Windows\\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe"	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}\stubpath = "C:\\Windows\\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe"	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E0656E8-C38E-4357-92F7-69735FC553AD}	{21873168-2952-4009-8CF2-353C54F91646}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}	{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC3A56B-5862-40a5-9344-D4B349F546E1}\stubpath = "C:\\Windows\\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe"	{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2845C377-E238-4dbc-B1C1-E0043F72E436}\stubpath = "C:\\Windows\\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe"	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{491FA3FC-379F-451c-A6A4-94E9291C0310}	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}\stubpath = "C:\\Windows\\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe"	{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}\stubpath = "C:\\Windows\\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe"	{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBC3A56B-5862-40a5-9344-D4B349F546E1}	{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21873168-2952-4009-8CF2-353C54F91646}	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21873168-2952-4009-8CF2-353C54F91646}\stubpath = "C:\\Windows\\{21873168-2952-4009-8CF2-353C54F91646}.exe"	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E0656E8-C38E-4357-92F7-69735FC553AD}\stubpath = "C:\\Windows\\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe"	{21873168-2952-4009-8CF2-353C54F91646}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}	{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}\stubpath = "C:\\Windows\\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe"	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2845C377-E238-4dbc-B1C1-E0043F72E436}	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8736918-22D7-45b0-B1E8-47F9B7826C67}	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8736918-22D7-45b0-B1E8-47F9B7826C67}\stubpath = "C:\\Windows\\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe"	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe

Deletes itself 1 IoCs

pid	Process
2608	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
1264	{21873168-2952-4009-8CF2-353C54F91646}.exe
1188	{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
2516	{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
2216	{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
596	{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
File created	C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
File created	C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
File created	C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe	{21873168-2952-4009-8CF2-353C54F91646}.exe
File created	C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe	{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
File created	C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe	{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
File created	C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
File created	C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
File created	C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
File created	C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
File created	C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe	{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
Token: SeIncBasePriorityPrivilege	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
Token: SeIncBasePriorityPrivilege	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
Token: SeIncBasePriorityPrivilege	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
Token: SeIncBasePriorityPrivilege	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
Token: SeIncBasePriorityPrivilege	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
Token: SeIncBasePriorityPrivilege	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe
Token: SeIncBasePriorityPrivilege	1188	{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
Token: SeIncBasePriorityPrivilege	2516	{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
Token: SeIncBasePriorityPrivilege	2216	{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2956	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	28
PID 2932 wrote to memory of 2956	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	28
PID 2932 wrote to memory of 2956	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	28
PID 2932 wrote to memory of 2956	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	28
PID 2932 wrote to memory of 2608	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	29
PID 2932 wrote to memory of 2608	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	29
PID 2932 wrote to memory of 2608	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	29
PID 2932 wrote to memory of 2608	2932	2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe	29
PID 2956 wrote to memory of 2028	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	30
PID 2956 wrote to memory of 2028	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	30
PID 2956 wrote to memory of 2028	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	30
PID 2956 wrote to memory of 2028	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	30
PID 2956 wrote to memory of 2676	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	31
PID 2956 wrote to memory of 2676	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	31
PID 2956 wrote to memory of 2676	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	31
PID 2956 wrote to memory of 2676	2956	{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe	31
PID 2028 wrote to memory of 2556	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	32
PID 2028 wrote to memory of 2556	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	32
PID 2028 wrote to memory of 2556	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	32
PID 2028 wrote to memory of 2556	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	32
PID 2028 wrote to memory of 2656	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	33
PID 2028 wrote to memory of 2656	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	33
PID 2028 wrote to memory of 2656	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	33
PID 2028 wrote to memory of 2656	2028	{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe	33
PID 2556 wrote to memory of 2408	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	36
PID 2556 wrote to memory of 2408	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	36
PID 2556 wrote to memory of 2408	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	36
PID 2556 wrote to memory of 2408	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	36
PID 2556 wrote to memory of 2720	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	37
PID 2556 wrote to memory of 2720	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	37
PID 2556 wrote to memory of 2720	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	37
PID 2556 wrote to memory of 2720	2556	{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe	37
PID 2408 wrote to memory of 2768	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	38
PID 2408 wrote to memory of 2768	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	38
PID 2408 wrote to memory of 2768	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	38
PID 2408 wrote to memory of 2768	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	38
PID 2408 wrote to memory of 1244	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	39
PID 2408 wrote to memory of 1244	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	39
PID 2408 wrote to memory of 1244	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	39
PID 2408 wrote to memory of 1244	2408	{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe	39
PID 2768 wrote to memory of 2300	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	40
PID 2768 wrote to memory of 2300	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	40
PID 2768 wrote to memory of 2300	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	40
PID 2768 wrote to memory of 2300	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	40
PID 2768 wrote to memory of 1268	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	41
PID 2768 wrote to memory of 1268	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	41
PID 2768 wrote to memory of 1268	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	41
PID 2768 wrote to memory of 1268	2768	{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe	41
PID 2300 wrote to memory of 1264	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	42
PID 2300 wrote to memory of 1264	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	42
PID 2300 wrote to memory of 1264	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	42
PID 2300 wrote to memory of 1264	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	42
PID 2300 wrote to memory of 1256	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	43
PID 2300 wrote to memory of 1256	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	43
PID 2300 wrote to memory of 1256	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	43
PID 2300 wrote to memory of 1256	2300	{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe	43
PID 1264 wrote to memory of 1188	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	44
PID 1264 wrote to memory of 1188	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	44
PID 1264 wrote to memory of 1188	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	44
PID 1264 wrote to memory of 1188	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	44
PID 1264 wrote to memory of 2036	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	45
PID 1264 wrote to memory of 2036	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	45
PID 1264 wrote to memory of 2036	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	45
PID 1264 wrote to memory of 2036	1264	{21873168-2952-4009-8CF2-353C54F91646}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_39fc6a37b1b3a7574cbf8d757353b255_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
  C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
    C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
      C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
        
        C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
        
        C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
        
        C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe
        
        C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
        
        C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
        
        C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
        
        C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe
        
        C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe
        12⤵
        Executes dropped EXE
        
        PID:596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BCDC6~1.EXE > nul
        12⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FE100~1.EXE > nul
        11⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E065~1.EXE > nul
        10⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{21873~1.EXE > nul
        9⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8736~1.EXE > nul
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A5196~1.EXE > nul
        7⤵
        
        PID:1268
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{491FA~1.EXE > nul
        6⤵
        
        PID:1244
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2845C~1.EXE > nul
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F52CF~1.EXE > nul
      4⤵
      PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2D6B8~1.EXE > nul
    3⤵
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{21873168-2952-4009-8CF2-353C54F91646}.exe

Filesize
372KB

MD5
1bb57a4316c2a45c4e76e8ac27f381df

SHA1
8179c04ce873a2a756343f967bc83e3bedfad30e

SHA256
ae4c82fe42712dc2a0f4688c0ce98a07a5ed7dbf06c4aa62eda98954dfbb3493

SHA512
44c80516727dd085c9e2d793856d0d81a486edb8cc58d98a03269f06bcab6762c650d7b9296e5f724a43e6ff487f99e5111efdeb6395aa7a0d564c7c2b95e990

Download Submit
C:\Windows\{2845C377-E238-4dbc-B1C1-E0043F72E436}.exe

Filesize
372KB

MD5
0227cc9ac093d90fb718c1bca8cbbe69

SHA1
60da259c9cca29357758196868292f66c0e6cb1e

SHA256
da3069c2fdbaf6ad539dcc91c2c6acf72eaed05195ccb3261514a493009dc199

SHA512
8a5933d7e8148e933d839faa5273b833ec25bf1ebaf4eb65a74f1dd4d98a80ac58351b35fa0a982b4c476ec24613ad174093b2cd18c86515afeae3687a069a89

Download Submit
C:\Windows\{2D6B8D1B-C450-4e14-B3EA-BEE1422CCA9B}.exe

Filesize
372KB

MD5
c5d1d8a67540c1c521432eef0ef558d5

SHA1
dcf5ec643d85a8f0d11413e5e0d15d30df7bd99b

SHA256
b4d6e8d24bfcd55b471a6975d6650f77f5e9f7b64843111b13936a7fcb55c378

SHA512
a43a5436b53a386d0f376b86af49d80fad26edaf01f2c02e8b2a4bf124df49bd17c230f8379277d216e178d7bb3004d5aa5e5385454357445c8adf490e89ee59

Download Submit
C:\Windows\{491FA3FC-379F-451c-A6A4-94E9291C0310}.exe

Filesize
372KB

MD5
f3cf935fb8ca24bb36b23844e0e7f65b

SHA1
444bf2924f2ce1627c9c003909eb61a69f37f681

SHA256
ea313067ee9fb01442d699c08c6c69c31232ccd6cbfece073871da90902a05d8

SHA512
2a97559ce4205df2d4baae9d12034a900843ee301e844ef74c5df8cd45d38b79978e6e503a6d48d2ab3e973c7be5759a5f9e846df717e54835b20dce7d8b1155

Download Submit
C:\Windows\{6E0656E8-C38E-4357-92F7-69735FC553AD}.exe

Filesize
372KB

MD5
99d8b18508d7b88cc3e4843fcd4eae0d

SHA1
802f46c1676c02e81e1d62263c8d173c42be30dd

SHA256
6795a1feedf03b0506549de8a3c08b2163495b400a4d09e9e919ec6eeb514bb9

SHA512
3e8bf6aaa5e4061a2f6d782ca713eb002c7c9ae4ca739746b890d69a11346dad7968116ae98c9152613bfe00a8d81cb8b7884bb95fc272b2122fb22f68505c16

Download Submit
C:\Windows\{A51969B0-EC48-4885-A455-A1A8E61BEDFF}.exe

Filesize
372KB

MD5
8a9626981b6a32fe1754992215b1d3b9

SHA1
a57a23336b59c0b05c9ddaa0e6ae2bc9e57fc353

SHA256
780bce42837b432fe2ecaa45afc111c330e4f1f57a84c586ab59bf33b859cc76

SHA512
f53251749b39f274405a2dbd11f79ee341e68c2b4865d9107f988344a6d629437ccc80d0c1583eddd8478cd3a12d6291696889f9b076f8dae5f4b624fb1585ec

Download Submit
C:\Windows\{B8736918-22D7-45b0-B1E8-47F9B7826C67}.exe

Filesize
372KB

MD5
4d3047b9f42d8408c0471f1f26d8b7af

SHA1
c3a2b8813e81a59d333a6814377c5466ee131bc2

SHA256
4a20246569013524866f152c90253210b8d8dc1539854e88f6fcc516474e87d4

SHA512
da7b446d0f23348313ebcb40a1580bd5c2536d84e18254421c8811d2b0506435fd67c7ff431a6ac37963a8b9fe3a7f6b0852df9cdf719e10787f07da9ddbada7

Download Submit
C:\Windows\{BCDC60AD-7F07-48a4-8A86-92A6F10CE3E5}.exe

Filesize
372KB

MD5
bdea93b2fbe036976e0e2ba4a7bfe93a

SHA1
6038d619ea7b9f29fec122855aa08c339c0185ce

SHA256
6e4416432f8942cb3d8685f53c92c612f848e5279cac0afead7217596a60e563

SHA512
5a8e336cfca9e9bc7b256d75c2486eef551d2bcc2615d54fd9411b01abdfabe2fad94275cb00fa36a00117c2e60e71c7ebef5881cb6cdc768e501508b5953428

Download Submit
C:\Windows\{CBC3A56B-5862-40a5-9344-D4B349F546E1}.exe

Filesize
372KB

MD5
c8a88a57c3f0bab3fba5d7aad1f29c8e

SHA1
1c46325ccd25bd8f2f4c5446baece968fcebf0c4

SHA256
df3e24646764b5f83546d81346ce2aec9474f4b60c31f697be5ecb0ab66f74e7

SHA512
8ad52f9731479467f46aaed3be3c21ad1010e00201c6703ca93faa2377c51fbf35c7ac87c6aba2a4adea4f57e3b870dfe956625522b99a8873a823872b897bab

Download Submit
C:\Windows\{F52CF6FE-B9A3-4f27-90B8-6D96D7B28850}.exe

Filesize
372KB

MD5
51cb69aeb02d633e13ba39e1d760755d

SHA1
c487718d014fc662a638bbb9e09c8da98ab51739

SHA256
c46900acd1ab59cbb92e0af6969a2a99c33211ae45c207a58aa3c81a02c5113c

SHA512
2239584fd4e6228f0980af04a8a556a1ee8e03bdda9acb2d470509850f168bc0fda7ca93c0a59c11f299deb86e8b6ab45fbf626d58e5122bd7791ed7ca19f849

Download Submit
C:\Windows\{FE1008E1-50BE-43ab-AF2A-F83F865185CD}.exe

Filesize
372KB

MD5
656294f6d2b21611b16708378832f8d3

SHA1
2564ad77eff359054c4858809ad07863849abac6

SHA256
90706389b634195ed85f977e41864178ea0ebfa6ad637cca131b23a34bf6cd96

SHA512
c0475d162606e5db92db0a4749493aa806ddfeb930aa195a5ac6d90fb2af4cd198266454d48c3cfa7f2dfbcd5aabd6d20ed825185aa7f7384a67e58b11909e50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads