9e13a4cec6b747f63d7f32a27e952e8deade7bc89d6bd7eeb11a97e5ff5a416a

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
Size

197KB
MD5

1ec6548b8b88f9bc545688562bc29d9f
SHA1

726fac709309e23e7f6c05e6816f28cf910ee997
SHA256

9e13a4cec6b747f63d7f32a27e952e8deade7bc89d6bd7eeb11a97e5ff5a416a
SHA512

8902ee04eb3aa028d105be01aaea9084f3de5781b7241ff3febc97bed646a71229b6e26f0bc10f3e3085f881d900f6d611c52b1b76d7e2d20205e34ed014cc87
SSDEEP

3072:jEGh0oYl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGWlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224e-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001232e-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001224e-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002d000000014665-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001224e-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001224e-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001224e-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}\stubpath = "C:\\Windows\\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe"	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}\stubpath = "C:\\Windows\\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe"	{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}\stubpath = "C:\\Windows\\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe"	{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}	{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}	{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}	{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}\stubpath = "C:\\Windows\\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe"	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A28A59C7-EC21-4639-96F4-A77EB80F127B}\stubpath = "C:\\Windows\\{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe"	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}\stubpath = "C:\\Windows\\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe"	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}\stubpath = "C:\\Windows\\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe"	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A28A59C7-EC21-4639-96F4-A77EB80F127B}	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}\stubpath = "C:\\Windows\\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe"	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}\stubpath = "C:\\Windows\\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe"	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}\stubpath = "C:\\Windows\\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe"	{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}\stubpath = "C:\\Windows\\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe"	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe

Deletes itself 1 IoCs

pid	Process
2512	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
2836	{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
1760	{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
2160	{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
336	{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe	{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
File created	C:\Windows\{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
File created	C:\Windows\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
File created	C:\Windows\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
File created	C:\Windows\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
File created	C:\Windows\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
File created	C:\Windows\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe	{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
File created	C:\Windows\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
File created	C:\Windows\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
File created	C:\Windows\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
File created	C:\Windows\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe	{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
Token: SeIncBasePriorityPrivilege	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
Token: SeIncBasePriorityPrivilege	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
Token: SeIncBasePriorityPrivilege	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
Token: SeIncBasePriorityPrivilege	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
Token: SeIncBasePriorityPrivilege	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
Token: SeIncBasePriorityPrivilege	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
Token: SeIncBasePriorityPrivilege	2836	{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
Token: SeIncBasePriorityPrivilege	1760	{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
Token: SeIncBasePriorityPrivilege	2160	{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2156	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	28
PID 1812 wrote to memory of 2156	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	28
PID 1812 wrote to memory of 2156	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	28
PID 1812 wrote to memory of 2156	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	28
PID 1812 wrote to memory of 2512	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	29
PID 1812 wrote to memory of 2512	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	29
PID 1812 wrote to memory of 2512	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	29
PID 1812 wrote to memory of 2512	1812	2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe	29
PID 2156 wrote to memory of 2636	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	30
PID 2156 wrote to memory of 2636	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	30
PID 2156 wrote to memory of 2636	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	30
PID 2156 wrote to memory of 2636	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	30
PID 2156 wrote to memory of 2892	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	31
PID 2156 wrote to memory of 2892	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	31
PID 2156 wrote to memory of 2892	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	31
PID 2156 wrote to memory of 2892	2156	{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe	31
PID 2636 wrote to memory of 2884	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	32
PID 2636 wrote to memory of 2884	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	32
PID 2636 wrote to memory of 2884	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	32
PID 2636 wrote to memory of 2884	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	32
PID 2636 wrote to memory of 2648	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	33
PID 2636 wrote to memory of 2648	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	33
PID 2636 wrote to memory of 2648	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	33
PID 2636 wrote to memory of 2648	2636	{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe	33
PID 2884 wrote to memory of 2980	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	36
PID 2884 wrote to memory of 2980	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	36
PID 2884 wrote to memory of 2980	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	36
PID 2884 wrote to memory of 2980	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	36
PID 2884 wrote to memory of 1260	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	37
PID 2884 wrote to memory of 1260	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	37
PID 2884 wrote to memory of 1260	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	37
PID 2884 wrote to memory of 1260	2884	{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe	37
PID 2980 wrote to memory of 2864	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	38
PID 2980 wrote to memory of 2864	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	38
PID 2980 wrote to memory of 2864	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	38
PID 2980 wrote to memory of 2864	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	38
PID 2980 wrote to memory of 2964	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	39
PID 2980 wrote to memory of 2964	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	39
PID 2980 wrote to memory of 2964	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	39
PID 2980 wrote to memory of 2964	2980	{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe	39
PID 2864 wrote to memory of 2604	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	40
PID 2864 wrote to memory of 2604	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	40
PID 2864 wrote to memory of 2604	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	40
PID 2864 wrote to memory of 2604	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	40
PID 2864 wrote to memory of 2116	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	41
PID 2864 wrote to memory of 2116	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	41
PID 2864 wrote to memory of 2116	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	41
PID 2864 wrote to memory of 2116	2864	{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe	41
PID 2604 wrote to memory of 1584	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	42
PID 2604 wrote to memory of 1584	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	42
PID 2604 wrote to memory of 1584	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	42
PID 2604 wrote to memory of 1584	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	42
PID 2604 wrote to memory of 2624	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	43
PID 2604 wrote to memory of 2624	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	43
PID 2604 wrote to memory of 2624	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	43
PID 2604 wrote to memory of 2624	2604	{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe	43
PID 1584 wrote to memory of 2836	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	44
PID 1584 wrote to memory of 2836	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	44
PID 1584 wrote to memory of 2836	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	44
PID 1584 wrote to memory of 2836	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	44
PID 1584 wrote to memory of 1732	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	45
PID 1584 wrote to memory of 1732	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	45
PID 1584 wrote to memory of 1732	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	45
PID 1584 wrote to memory of 1732	1584	{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_1ec6548b8b88f9bc545688562bc29d9f_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
  C:\Windows\{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
    C:\Windows\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
      C:\Windows\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
        
        C:\Windows\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Windows\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
        
        C:\Windows\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
        
        C:\Windows\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
        
        C:\Windows\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
        
        C:\Windows\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
        
        C:\Windows\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
        
        C:\Windows\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe
        
        C:\Windows\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe
        12⤵
        Executes dropped EXE
        
        PID:336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8B076~1.EXE > nul
        12⤵
        
        PID:576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{762A8~1.EXE > nul
        11⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02BB8~1.EXE > nul
        10⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{876A1~1.EXE > nul
        9⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{410CE~1.EXE > nul
        8⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C3C6~1.EXE > nul
        7⤵
        
        PID:2116
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4EA47~1.EXE > nul
        6⤵
        
        PID:2964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E92FB~1.EXE > nul
        5⤵
        
        PID:1260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1C3AB~1.EXE > nul
      4⤵
      PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A28A5~1.EXE > nul
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02BB8FF4-F516-44c5-8936-2CDA4982ED7A}.exe

Filesize
197KB

MD5
60b6b138caddc121c473a74e91d0dc04

SHA1
e8883477a36aca79c9510e43042e83e59ca56f46

SHA256
6bb008815a47c6be95222f29e703ba15b08a2e136bee1fb568bfc957f754c1d2

SHA512
6b42bd664dfc179fb8da5a6bb8aa4bac4214d83b3d1fe02c917de778504aafb282cd10645b44e00a3d8e7ba6dd14019081a69ba7bd94c7aa1cfedf48280b607a

Download Submit
C:\Windows\{1C3AB47D-7946-4ad6-A939-73D4EE67A2EC}.exe

Filesize
197KB

MD5
5c5ebf01bce5c8fa4f51b0155380341f

SHA1
376cf6afac3e7b16d342086ba1eb9dc7c156b61e

SHA256
1acbd1ad003efe5cb56174a2425ad394ebdc2ac4ecd8d227086f8efa8efd59ba

SHA512
84090353d6152eeaa8a38626bfdb53333079eb4b4745308473dd1bdd6abe0b6460963e209f823dee4432cbe9dc0bd01fa20c134e052dbc7dafef86653e808c3c

Download Submit
C:\Windows\{410CE88F-FB8A-42a5-B5A2-052565E50BA7}.exe

Filesize
197KB

MD5
4d5c30d1d0bb95e9c6c1923499c59ce7

SHA1
4deb08650a5246a3e0fdd66146978721e984223a

SHA256
56836e4c0d7068e36e2eeab87db29ac0f8e280d3cbb37f2c4ed345c6f00b8b57

SHA512
2edf4d28a4ffcf949545f6114c3b41df6089251d7fc063c5c537ac71094c95c7d0f2b36abc8428fd5725562490bd8a430c64d080a923deacb96785ccf3272980

Download Submit
C:\Windows\{4EA47F10-6292-40a9-A83E-A9E208BAD6D3}.exe

Filesize
197KB

MD5
e483a0b46a548383c1adbbfec25f078f

SHA1
675cef982efcd2ba6b0ffc7bec44d5b1274bf182

SHA256
da5a7b9754c27a71e0ab4e665814325bcbe7912b2378f2a4950b0c1ac375b9fb

SHA512
52c0612abf9561c68b071cc096d19367461169d8ae60fa8dc1b359107b32ab7891361c770494dfcaf5d9a545a1ff7b3d3e5bd1a4bb635b22c92e02c40d6e00b2

Download Submit
C:\Windows\{762A8514-1CB6-49ca-9BF2-EF4386F1D3C5}.exe

Filesize
197KB

MD5
4660f299a4eacb3c631eecbe41150e05

SHA1
1dfeb67d2f79cc59aa7a255a76e85324142750f8

SHA256
f15aaa35a50e31c7f1414bd495bda3b71784553d60c53797dca7884901b1321b

SHA512
6f3969a22ff5031155e768c1d431cb416e07ae20008fa8bce2f6a5899c8431c342dfa96dabe8b3f03adf0504001136cc6ac0e46ec78aa60ea41687eab41fabf5

Download Submit
C:\Windows\{876A1521-8E7C-4cbe-B06D-3A6EF2F857F8}.exe

Filesize
197KB

MD5
168ebff7f0410dd9140a80c35ee242a2

SHA1
70a76ddd1ca6940a38fb83ca494f0191623884e1

SHA256
a34a3afd3465050c704b450614bde090d2e6dc25e0a0aa6821d1e406cb8f1179

SHA512
065881137bffad868646f081435e335e1abdfe63bef1abe825530ce7206c2eb0ad6b56d8cb1fbd065df74aee39f930c6b2d2cc7195cfd4e9f3b45827dbd5a204

Download Submit
C:\Windows\{8B076445-88DC-46c0-8492-5BC6DDA97D2D}.exe

Filesize
197KB

MD5
2fcd83b0da6d5e61911e8af7b5bfd09d

SHA1
ecaeb538cc30c4a462cfff3b2f69a19edfb3061b

SHA256
71e7c3b4a710dfb217c4d52854c4fe0424cc4892bee535398f919ea606dac2f9

SHA512
36230d09461c6c0eb985a1f01671f3497568f605506585aad7dd27d799d292a78f9520cfe6ac5e9c368433d127c4915b0e98735ac9873a289d0ba4591e6ab35b

Download Submit
C:\Windows\{9BAC3B7F-4559-430e-B7F3-8E28C2C71F86}.exe

Filesize
197KB

MD5
95e7a4f789ea21e657a68056d0dc13a4

SHA1
51d7d72797ff3e604cc03cb6965b6f88155452f0

SHA256
3cfe621dc6647bbc539bf7fc543b48d52038f3f97fda5235284ead63b54448e8

SHA512
6c442d92a52583d22f2c5401d993291c3f3bbc320189bfc23f1f6fb403c3dbb7fe3f9b4b1311fee26abb4173ee5651cb767993bf0ea3de65717732a361521d33

Download Submit
C:\Windows\{9C3C6D0C-8DB2-4606-8A03-ED8449DB7664}.exe

Filesize
197KB

MD5
d9a09c95a2facb9c0bccf606e6dcda2e

SHA1
790c9d750163b9c2ad3440a44cebbbe42495f6e5

SHA256
b5d6b8174e52f3d0692a1509c1828c6718027d5d6d426831921ac061729fa200

SHA512
dc9e87d54fb384034179040b7b53fbf01bce164bf60ae623ee9528c5b5704059961e9ade0f1b0c075cbc485d58c3c0ca636c93f48f3987eae505383e28d2d0cd

Download Submit
C:\Windows\{A28A59C7-EC21-4639-96F4-A77EB80F127B}.exe

Filesize
197KB

MD5
8d54b07c7ed7be253bd1e360ac3d5529

SHA1
0aac2d6a28d3e6233fcfd8c86a158f37a1f725ab

SHA256
4aaee1f31697ce203f1df7111d9006cb42a80fc6ae7d6411c94cca0db277bf7c

SHA512
f3f9ab3a92461e519bce621f69a4c7603b4fb78947112abc76cb927dd59fb336da2a123ef1c9ee2156ae52a02b64f0a19bbb8c92ac180c5c1ea09c0aa2346bc4

Download Submit
C:\Windows\{E92FB87F-5AC9-4ad8-B2A2-C4E8B5CD60FD}.exe

Filesize
197KB

MD5
9279ccbacffa2131e1e23ac1a9bd6e53

SHA1
dc48a770eec3a0c3127dcc5444c3e8098ebdcfb0

SHA256
4580baf7f5289be25078831c2626e68c1c1d8335e18bfb856e01190425f374c6

SHA512
c883f29b5a2551008f3cec5bb170f399bb6cdb700a3ff0213db0ab88493ad6dc20573bec3d470b2bf2cf9cd328b954b15ac4b12dc94ebac98622f5dec4acba39

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads