228ecdbf8f8b327f6b27cf8dba3b1a2d580438cd205550417bfbb3dc6a9d53f4

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Size

216KB
MD5

6c1a6ed33785a1700d85fa0f682e6f36
SHA1

e5ac21c4c10e2f6486f666f6f63cb3503d9f2e77
SHA256

228ecdbf8f8b327f6b27cf8dba3b1a2d580438cd205550417bfbb3dc6a9d53f4
SHA512

8c8094cd37d194e69fcad58121f6055b7d2884e2449bc19ad82a9cdf7200871690f4f4e3c9cfc253e5bb4a2defc6c03543efe7adc6c0c4e80f8ba9523aa65344
SSDEEP

3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGNlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001223a-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000012248-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001223a-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f2-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0029000000018b27-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0029000000018b36-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f2-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0012000000018b46-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000018b79-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27A05022-EA2E-4264-BD80-ED9316196782}	{9CB87582-B08A-4b77-A132-50743E248B66}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CC21B32-1F1A-428e-8D6A-80E070640086}	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CC21B32-1F1A-428e-8D6A-80E070640086}\stubpath = "C:\\Windows\\{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe"	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE84E261-CC22-4c84-A6CC-149E607DABBB}	{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0180B349-01FD-41f3-9D87-236946B5F465}\stubpath = "C:\\Windows\\{0180B349-01FD-41f3-9D87-236946B5F465}.exe"	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27A05022-EA2E-4264-BD80-ED9316196782}\stubpath = "C:\\Windows\\{27A05022-EA2E-4264-BD80-ED9316196782}.exe"	{9CB87582-B08A-4b77-A132-50743E248B66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}\stubpath = "C:\\Windows\\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe"	{27A05022-EA2E-4264-BD80-ED9316196782}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}\stubpath = "C:\\Windows\\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe"	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AD74584-196B-469a-B4DB-31728AD355B8}	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9AD74584-196B-469a-B4DB-31728AD355B8}\stubpath = "C:\\Windows\\{9AD74584-196B-469a-B4DB-31728AD355B8}.exe"	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0180B349-01FD-41f3-9D87-236946B5F465}	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CB87582-B08A-4b77-A132-50743E248B66}	{0180B349-01FD-41f3-9D87-236946B5F465}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE84E261-CC22-4c84-A6CC-149E607DABBB}\stubpath = "C:\\Windows\\{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe"	{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4A4574C-1179-44a0-8244-D50E44B81407}\stubpath = "C:\\Windows\\{A4A4574C-1179-44a0-8244-D50E44B81407}.exe"	{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CB87582-B08A-4b77-A132-50743E248B66}\stubpath = "C:\\Windows\\{9CB87582-B08A-4b77-A132-50743E248B66}.exe"	{0180B349-01FD-41f3-9D87-236946B5F465}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}	{27A05022-EA2E-4264-BD80-ED9316196782}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}\stubpath = "C:\\Windows\\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe"	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE6F6C16-15A7-4721-8916-199FD815D4A9}	{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AE6F6C16-15A7-4721-8916-199FD815D4A9}\stubpath = "C:\\Windows\\{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe"	{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4A4574C-1179-44a0-8244-D50E44B81407}	{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe
2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe
2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe
2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
788	{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
320	{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
2100	{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe
1508	{A4A4574C-1179-44a0-8244-D50E44B81407}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
File created	C:\Windows\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
File created	C:\Windows\{9AD74584-196B-469a-B4DB-31728AD355B8}.exe	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
File created	C:\Windows\{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe	{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
File created	C:\Windows\{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe	{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
File created	C:\Windows\{27A05022-EA2E-4264-BD80-ED9316196782}.exe	{9CB87582-B08A-4b77-A132-50743E248B66}.exe
File created	C:\Windows\{9CB87582-B08A-4b77-A132-50743E248B66}.exe	{0180B349-01FD-41f3-9D87-236946B5F465}.exe
File created	C:\Windows\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	{27A05022-EA2E-4264-BD80-ED9316196782}.exe
File created	C:\Windows\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
File created	C:\Windows\{A4A4574C-1179-44a0-8244-D50E44B81407}.exe	{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe
File created	C:\Windows\{0180B349-01FD-41f3-9D87-236946B5F465}.exe	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe
Token: SeIncBasePriorityPrivilege	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe
Token: SeIncBasePriorityPrivilege	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe
Token: SeIncBasePriorityPrivilege	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
Token: SeIncBasePriorityPrivilege	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
Token: SeIncBasePriorityPrivilege	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
Token: SeIncBasePriorityPrivilege	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
Token: SeIncBasePriorityPrivilege	788	{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
Token: SeIncBasePriorityPrivilege	320	{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
Token: SeIncBasePriorityPrivilege	2100	{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2064	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	28
PID 2488 wrote to memory of 2064	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	28
PID 2488 wrote to memory of 2064	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	28
PID 2488 wrote to memory of 2064	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	28
PID 2488 wrote to memory of 2544	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	29
PID 2488 wrote to memory of 2544	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	29
PID 2488 wrote to memory of 2544	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	29
PID 2488 wrote to memory of 2544	2488	2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe	29
PID 2064 wrote to memory of 2412	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	30
PID 2064 wrote to memory of 2412	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	30
PID 2064 wrote to memory of 2412	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	30
PID 2064 wrote to memory of 2412	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	30
PID 2064 wrote to memory of 2520	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	31
PID 2064 wrote to memory of 2520	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	31
PID 2064 wrote to memory of 2520	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	31
PID 2064 wrote to memory of 2520	2064	{0180B349-01FD-41f3-9D87-236946B5F465}.exe	31
PID 2412 wrote to memory of 2524	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	34
PID 2412 wrote to memory of 2524	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	34
PID 2412 wrote to memory of 2524	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	34
PID 2412 wrote to memory of 2524	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	34
PID 2412 wrote to memory of 2908	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	35
PID 2412 wrote to memory of 2908	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	35
PID 2412 wrote to memory of 2908	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	35
PID 2412 wrote to memory of 2908	2412	{9CB87582-B08A-4b77-A132-50743E248B66}.exe	35
PID 2524 wrote to memory of 2028	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	36
PID 2524 wrote to memory of 2028	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	36
PID 2524 wrote to memory of 2028	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	36
PID 2524 wrote to memory of 2028	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	36
PID 2524 wrote to memory of 684	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	37
PID 2524 wrote to memory of 684	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	37
PID 2524 wrote to memory of 684	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	37
PID 2524 wrote to memory of 684	2524	{27A05022-EA2E-4264-BD80-ED9316196782}.exe	37
PID 2028 wrote to memory of 572	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	38
PID 2028 wrote to memory of 572	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	38
PID 2028 wrote to memory of 572	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	38
PID 2028 wrote to memory of 572	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	38
PID 2028 wrote to memory of 2608	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	39
PID 2028 wrote to memory of 2608	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	39
PID 2028 wrote to memory of 2608	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	39
PID 2028 wrote to memory of 2608	2028	{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe	39
PID 572 wrote to memory of 2592	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	40
PID 572 wrote to memory of 2592	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	40
PID 572 wrote to memory of 2592	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	40
PID 572 wrote to memory of 2592	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	40
PID 572 wrote to memory of 2492	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	41
PID 572 wrote to memory of 2492	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	41
PID 572 wrote to memory of 2492	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	41
PID 572 wrote to memory of 2492	572	{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe	41
PID 2592 wrote to memory of 1084	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	42
PID 2592 wrote to memory of 1084	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	42
PID 2592 wrote to memory of 1084	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	42
PID 2592 wrote to memory of 1084	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	42
PID 2592 wrote to memory of 1944	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	43
PID 2592 wrote to memory of 1944	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	43
PID 2592 wrote to memory of 1944	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	43
PID 2592 wrote to memory of 1944	2592	{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe	43
PID 1084 wrote to memory of 788	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	44
PID 1084 wrote to memory of 788	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	44
PID 1084 wrote to memory of 788	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	44
PID 1084 wrote to memory of 788	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	44
PID 1084 wrote to memory of 896	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	45
PID 1084 wrote to memory of 896	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	45
PID 1084 wrote to memory of 896	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	45
PID 1084 wrote to memory of 896	1084	{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_6c1a6ed33785a1700d85fa0f682e6f36_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\{0180B349-01FD-41f3-9D87-236946B5F465}.exe
  C:\Windows\{0180B349-01FD-41f3-9D87-236946B5F465}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\{9CB87582-B08A-4b77-A132-50743E248B66}.exe
    C:\Windows\{9CB87582-B08A-4b77-A132-50743E248B66}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\{27A05022-EA2E-4264-BD80-ED9316196782}.exe
      C:\Windows\{27A05022-EA2E-4264-BD80-ED9316196782}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Windows\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
        
        C:\Windows\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
      - C:\Windows\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
        
        C:\Windows\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
        
        C:\Windows\{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
        
        C:\Windows\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
        
        C:\Windows\{9AD74584-196B-469a-B4DB-31728AD355B8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
        
        C:\Windows\{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
        
        C:\Windows\{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe
        
        C:\Windows\{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\{A4A4574C-1179-44a0-8244-D50E44B81407}.exe
        
        C:\Windows\{A4A4574C-1179-44a0-8244-D50E44B81407}.exe
        12⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE84E~1.EXE > nul
        12⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AE6F6~1.EXE > nul
        11⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9AD74~1.EXE > nul
        10⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79B68~1.EXE > nul
        9⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1CC21~1.EXE > nul
        8⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EB4FC~1.EXE > nul
        7⤵
        
        PID:2492
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7E4F~1.EXE > nul
        6⤵
        
        PID:2608
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{27A05~1.EXE > nul
        5⤵
        
        PID:684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{9CB87~1.EXE > nul
      4⤵
      PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0180B~1.EXE > nul
    3⤵
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0180B349-01FD-41f3-9D87-236946B5F465}.exe

Filesize
216KB

MD5
d5a894fc541faf4bec12583204042114

SHA1
a219744c5943cfe70d6c2db1e3208e38df34b90f

SHA256
f8159b4a4b6469b45b36cb78322cfed7b2c5ff1281abaf21fd3b6c5aa74b8995

SHA512
dfa47d034361f6e8143dbbc6d11d400b20db6b98d51162e401b4e1c5e6cf57ea9c19245e4984e2aac83d427c1f6c9cf0011b3a2cdcb57dc2cac33f6c1ddee939

Download Submit
C:\Windows\{1CC21B32-1F1A-428e-8D6A-80E070640086}.exe

Filesize
216KB

MD5
3ab20fee9982b8eb1e67172204c49a71

SHA1
f2f5cda4683f37674e2f770e64c33afda6dd9709

SHA256
95130a1c1d0d130d65dd39ae3f539d49df08bb6e3222b65b2bff6ece6d0e5bea

SHA512
54fbcf6dc34aea53978128bafcc3a04f63c48735426fe7fc7501e34e570c8a57c1954d58cc7b2a9bb623c07675ae05a8c60e6cb40c5626f2d3302fa43382c3b7

Download Submit
C:\Windows\{27A05022-EA2E-4264-BD80-ED9316196782}.exe

Filesize
216KB

MD5
9bd97cdac10cbe183f684e355c7c94e5

SHA1
925a28577e01c1dd155ed5156be8240fb871f958

SHA256
a6f54757f5abced4d126830313fbcee50899c14b7c73f625ef7fcb10413096f5

SHA512
dbdd236a3628aec322c423fa0933ee22f69e4672c88d41a04db1a9f249d76557fd1151a50ee7f56ed0551f6bf62ee533d6108e053b92cb4c3ed34c48e6fb91d8

Download Submit
C:\Windows\{79B68CA1-8A93-40a0-B3A8-793CD28E084F}.exe

Filesize
216KB

MD5
3fa6a6b6d1f69f9d122951e58e01f10a

SHA1
d7fa9f88e1568c02f56c50f632a3232f84625923

SHA256
19c44d06408d823d00eefbfa6234fcdf9517501a1f5028c7e2d0b3ede4a8fb9b

SHA512
c70daa7ee89ea4225657c9d6b2b53dfccbbddf1f4c389b761ae181b6c332d48edd1bfd310eb63a9c69ff1472091d3ae543f74e8640cdb17940e80fe85ef1298f

Download Submit
C:\Windows\{9AD74584-196B-469a-B4DB-31728AD355B8}.exe

Filesize
216KB

MD5
b20cffed634a5abbedb839f977f75e37

SHA1
f9d2a4f3289e6339c8c4bc6b0087c5de646133a5

SHA256
b9cd24560791f4c0c31e944fca1213fe2d96f6d6cecb045a50e57bb25ec5f35b

SHA512
b31d8ccb55d02237229947b684144149472c4930f232a915e8c94e12de2cc39c045d7ccc224aeab0b728144653cdc966e21595e21369eab4660485d6a850bd66

Download Submit
C:\Windows\{9CB87582-B08A-4b77-A132-50743E248B66}.exe

Filesize
216KB

MD5
164338bf8b63bd915d0db1d08d1df4b6

SHA1
af6ac981d526f328bb289cc6be0b0a47b0dcad40

SHA256
84212cc42cb4bbad69c6f595cbbaf29e1836ec81580c211469beed167aced6f1

SHA512
14e2afa0cbbcc37a46cf939204683bfeba78b23df1e8c1666b4dbca4cb49c25a0fb497fa2c15ebc48963fe0197302e12adad09af467ac59b49a66a536133d301

Download Submit
C:\Windows\{A4A4574C-1179-44a0-8244-D50E44B81407}.exe

Filesize
216KB

MD5
511f392315e2da54112561abbeb50304

SHA1
e3e81c1d40f1d624068433cce7f164ca03dd7116

SHA256
12a35ec7fb617332d37a808c2d3b74be17728f4d5252045fc9e6da16cd3b93a9

SHA512
3baef9d97bc6fa9c560f8c7f1b3fe50090b47e04c816c129025c26b7677c7812d9d65ec5ba42469b473a7cd5e1c6e09c667574f4394de66cffe545f455a1f7db

Download Submit
C:\Windows\{AE6F6C16-15A7-4721-8916-199FD815D4A9}.exe

Filesize
216KB

MD5
7fee2fe7a39cb81baa872d366138ba56

SHA1
3e95c40b03a96b39a7a141c48359bec5ecbb2dd9

SHA256
baefbcd1106937ad32b6b2797c4687c849098a6f54f9d07a64e12872cc1b9ec9

SHA512
fd08a34296bf1dc16a613f24e7606ecd68c119ca28fdf3f466f72aa52c37cf6e905111fe4c244ce209f50c7b4c3a92e685683a8ffdf82408b17945c0c83456c6

Download Submit
C:\Windows\{C7E4FF97-9FC0-4f6a-BF1F-62B3B88E929F}.exe

Filesize
216KB

MD5
86c27b504dacbf095a5bfaa4cf397856

SHA1
4b388b0501d6ad089486d70c935a5b9cad67acb5

SHA256
c4b5afff8ddceb77cb7dff677ee01b88507955b0abdec320a5459ef04c25e36a

SHA512
ea2e8e731e2f24382f5683b9efc15a3711b51c332d05dbc16dd9c18fc1522b8b3f3192ce8fe2064c99925bc7032f8929c884096e2d2b7bce090b87cd17f3e2f4

Download Submit
C:\Windows\{DE84E261-CC22-4c84-A6CC-149E607DABBB}.exe

Filesize
216KB

MD5
34801641f9a02cf5350af0bfdfa3759c

SHA1
10e87e3af26b5351aa9936daa3b39290d38d0302

SHA256
2a175738347b92ae8aa8de3c37a88b609eec8de1ae06e377b85c1052eee72a26

SHA512
a69c970c1b2e06b90de073c57c005a58d3a4a2becee93deb84912abf8147de71b2153e83aac9e6d4497a6f015201f807fac4632ae2aa40cfdd5f05c2fc531750

Download Submit
C:\Windows\{EB4FCF26-A990-4b8e-B486-7D2A144B71E2}.exe

Filesize
216KB

MD5
4571f35dc304a24cb65e42ec7725561b

SHA1
dff54e0115642a71bb1eb5e7fcab3f70b525ae73

SHA256
0c5dd50dcec03eda940feb06cf392ef2aedbac41779d1ca4eb6b73d9486dc648

SHA512
f014a3436ce887597216fb0acc13edf0e4a9bda00ff40baa2cc9d52dac0dadb4349259e8ab00febf114477775c29ab8a8b12113a75dd076ef2d8f015f3ec257f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads