fb191647efa2823ed17b899d37c1a2f9ef42b9f5c36ca8cf6ac94f0fcd4f0e47

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
Size

216KB
MD5

26848e9d5f96b5253b7ed800ab8349a0
SHA1

29d7a0def64f60c6e02cbb42bea269d77289c89f
SHA256

fb191647efa2823ed17b899d37c1a2f9ef42b9f5c36ca8cf6ac94f0fcd4f0e47
SHA512

91d639389a457d4837982a0c87b6f16a1a917df75637729161231897a00f6c096efda08d9e5e2d6446c755184dca6895f9c430af9f8d5e78c98dbce6eeed9e44
SSDEEP

3072:jEGh0o7l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGtlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x000800000002323d-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023252-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0009000000023255-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000022e9f-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a000000023255-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000022e9f-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000c000000023255-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000022e9f-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d000000023255-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000022d06-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0004000000022d09-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8474C992-4F7F-4d3e-B021-48AB649300AA}	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}\stubpath = "C:\\Windows\\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe"	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CB79456-E75A-413a-B1BC-B5E44437D986}	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6238F31-D052-47e5-B66B-C08F77945D22}	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FAE29EB-0264-47b4-8402-77798571AC1A}	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FAE29EB-0264-47b4-8402-77798571AC1A}\stubpath = "C:\\Windows\\{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe"	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4DCE158-2410-4933-915F-DC2BE66B86C4}	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4DCE158-2410-4933-915F-DC2BE66B86C4}\stubpath = "C:\\Windows\\{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe"	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01FC9345-32C8-4f87-A62E-90245DDFF390}\stubpath = "C:\\Windows\\{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe"	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5BFB26A-469B-4867-92E3-B26050D4C401}\stubpath = "C:\\Windows\\{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe"	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71738D82-2791-4fe7-BA04-0F593D565D4C}	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71738D82-2791-4fe7-BA04-0F593D565D4C}\stubpath = "C:\\Windows\\{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe"	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60B18F83-E0E1-41c0-BD37-8736AC34056E}	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}\stubpath = "C:\\Windows\\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe"	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8474C992-4F7F-4d3e-B021-48AB649300AA}\stubpath = "C:\\Windows\\{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe"	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01FC9345-32C8-4f87-A62E-90245DDFF390}	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5BFB26A-469B-4867-92E3-B26050D4C401}	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CB79456-E75A-413a-B1BC-B5E44437D986}\stubpath = "C:\\Windows\\{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe"	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6238F31-D052-47e5-B66B-C08F77945D22}\stubpath = "C:\\Windows\\{A6238F31-D052-47e5-B66B-C08F77945D22}.exe"	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60B18F83-E0E1-41c0-BD37-8736AC34056E}\stubpath = "C:\\Windows\\{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe"	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe

Executes dropped EXE 11 IoCs

pid	Process
640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
4896	{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
File created	C:\Windows\{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
File created	C:\Windows\{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
File created	C:\Windows\{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
File created	C:\Windows\{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
File created	C:\Windows\{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
File created	C:\Windows\{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
File created	C:\Windows\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
File created	C:\Windows\{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
File created	C:\Windows\{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
File created	C:\Windows\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
Token: SeIncBasePriorityPrivilege	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
Token: SeIncBasePriorityPrivilege	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
Token: SeIncBasePriorityPrivilege	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
Token: SeIncBasePriorityPrivilege	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
Token: SeIncBasePriorityPrivilege	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
Token: SeIncBasePriorityPrivilege	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
Token: SeIncBasePriorityPrivilege	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
Token: SeIncBasePriorityPrivilege	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
Token: SeIncBasePriorityPrivilege	1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 640	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	97
PID 2076 wrote to memory of 640	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	97
PID 2076 wrote to memory of 640	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	97
PID 2076 wrote to memory of 3104	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	99
PID 2076 wrote to memory of 3104	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	99
PID 2076 wrote to memory of 3104	2076	2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe	99
PID 640 wrote to memory of 4716	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	109
PID 640 wrote to memory of 4716	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	109
PID 640 wrote to memory of 4716	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	109
PID 640 wrote to memory of 1484	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	110
PID 640 wrote to memory of 1484	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	110
PID 640 wrote to memory of 1484	640	{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe	110
PID 4716 wrote to memory of 3504	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	112
PID 4716 wrote to memory of 3504	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	112
PID 4716 wrote to memory of 3504	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	112
PID 4716 wrote to memory of 4612	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	113
PID 4716 wrote to memory of 4612	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	113
PID 4716 wrote to memory of 4612	4716	{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe	113
PID 3504 wrote to memory of 4040	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	116
PID 3504 wrote to memory of 4040	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	116
PID 3504 wrote to memory of 4040	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	116
PID 3504 wrote to memory of 4048	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	117
PID 3504 wrote to memory of 4048	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	117
PID 3504 wrote to memory of 4048	3504	{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe	117
PID 4040 wrote to memory of 4356	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	118
PID 4040 wrote to memory of 4356	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	118
PID 4040 wrote to memory of 4356	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	118
PID 4040 wrote to memory of 3556	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	119
PID 4040 wrote to memory of 3556	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	119
PID 4040 wrote to memory of 3556	4040	{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe	119
PID 4356 wrote to memory of 3836	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	120
PID 4356 wrote to memory of 3836	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	120
PID 4356 wrote to memory of 3836	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	120
PID 4356 wrote to memory of 4368	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	121
PID 4356 wrote to memory of 4368	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	121
PID 4356 wrote to memory of 4368	4356	{A6238F31-D052-47e5-B66B-C08F77945D22}.exe	121
PID 3836 wrote to memory of 4104	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	123
PID 3836 wrote to memory of 4104	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	123
PID 3836 wrote to memory of 4104	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	123
PID 3836 wrote to memory of 868	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	124
PID 3836 wrote to memory of 868	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	124
PID 3836 wrote to memory of 868	3836	{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe	124
PID 4104 wrote to memory of 3952	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	125
PID 4104 wrote to memory of 3952	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	125
PID 4104 wrote to memory of 3952	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	125
PID 4104 wrote to memory of 3504	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	126
PID 4104 wrote to memory of 3504	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	126
PID 4104 wrote to memory of 3504	4104	{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe	126
PID 3952 wrote to memory of 1908	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	127
PID 3952 wrote to memory of 1908	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	127
PID 3952 wrote to memory of 1908	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	127
PID 3952 wrote to memory of 940	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	128
PID 3952 wrote to memory of 940	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	128
PID 3952 wrote to memory of 940	3952	{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe	128
PID 1908 wrote to memory of 1824	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	139
PID 1908 wrote to memory of 1824	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	139
PID 1908 wrote to memory of 1824	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	139
PID 1908 wrote to memory of 3304	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	140
PID 1908 wrote to memory of 3304	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	140
PID 1908 wrote to memory of 3304	1908	{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe	140
PID 1824 wrote to memory of 4896	1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe	141
PID 1824 wrote to memory of 4896	1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe	141
PID 1824 wrote to memory of 4896	1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe	141
PID 1824 wrote to memory of 2368	1824	{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe	142

C:\Users\Admin\AppData\Local\Temp\2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_26848e9d5f96b5253b7ed800ab8349a0_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
  C:\Windows\{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
    C:\Windows\{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
      C:\Windows\{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Windows\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
        
        C:\Windows\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
      - C:\Windows\{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
        
        C:\Windows\{A6238F31-D052-47e5-B66B-C08F77945D22}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
        
        C:\Windows\{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
        
        C:\Windows\{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
        
        C:\Windows\{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
        
        C:\Windows\{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
        
        C:\Windows\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe
        
        C:\Windows\{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe
        12⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A41DF~1.EXE > nul
        12⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8474C~1.EXE > nul
        11⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E4DCE~1.EXE > nul
        10⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FAE2~1.EXE > nul
        9⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{60B18~1.EXE > nul
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6238~1.EXE > nul
        7⤵
        
        PID:4368
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC907~1.EXE > nul
        6⤵
        
        PID:3556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71738~1.EXE > nul
        5⤵
        
        PID:4048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5CB79~1.EXE > nul
      4⤵
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D5BFB~1.EXE > nul
    3⤵
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{01FC9345-32C8-4f87-A62E-90245DDFF390}.exe

Filesize
216KB

MD5
86c33a71c00fd74f2769950363e871f3

SHA1
7040f8fec5817390afbd5994da173b125f7c1eee

SHA256
d71c6633eda8f690eb4fef9f4d6ba07f07279c9e06456dd2ceff6f47636b639a

SHA512
09e813f0c94d877134be479f428c56d40901ad3e3b5673af7ae7f9e16f9a3b7b9ada84f400181adca8f751ab309b60fc251508405169fab785911c65daee34b2

Download Submit
C:\Windows\{5CB79456-E75A-413a-B1BC-B5E44437D986}.exe

Filesize
216KB

MD5
99240d52525b68c64201377d4096dfc1

SHA1
68467aa1fc29094cc87b6970338cf293c7bd9fdf

SHA256
5fc412fa8596e1f3eadf22d6bf7fbda2a452372109055c13a881c6792c135710

SHA512
03ec5d21ec5106ca0d6e7d62fd4299215070d9622134b3f05ee049614bd48bc34f59481093d243acc430ace56b4e8c7065f281d0aed134ec5c5105daba3b539b

Download Submit
C:\Windows\{60B18F83-E0E1-41c0-BD37-8736AC34056E}.exe

Filesize
216KB

MD5
43591bda5c523f720f5b978707f08ee8

SHA1
7931df3dfb9667436b511f885c1be8bab3149056

SHA256
cdd391f9e4358b6e8bbb2f62d68a16c7ffe75133dce2842ca1d7fcfa7a36fb59

SHA512
f0b365826923ccc5a15ce6a985d3ef71d64971eb23678ca3b7334ad793531cb8768841dcd2d13347148f8bccfd19d6c3fc0306bab03a94d4bf1705309a324377

Download Submit
C:\Windows\{71738D82-2791-4fe7-BA04-0F593D565D4C}.exe

Filesize
216KB

MD5
cbd9940053a6b365362fb3eb3bc9beb3

SHA1
70bd2e6c39ae00458009c65eec52cd2f56f0432e

SHA256
65b111ad52ff72dbb4609e4de2b198c24acf830f5dceb5e2b6a6eeea9023a9ed

SHA512
a0cd891c1e31774e94a6286e820cd26c3478a323e4bd008a9cc8f7dcabd38f66a071576dea6127c7d52061064eb07d3eeff0aee6ad9d9ced0b49be0e737705b8

Download Submit
C:\Windows\{7FAE29EB-0264-47b4-8402-77798571AC1A}.exe

Filesize
216KB

MD5
0f94b9754515daaec50726dacc028432

SHA1
774bb1547508f6afecec883438aa6619b2ada316

SHA256
724ba17f78e179caae7759941f327a6a58b97c49d4aed06fd3012cc1c421938e

SHA512
e1909fa5c193956195b55f257e0791db0cbea4af1b2376c9acadbf2fdfcfcc2d25ef56dacc9bdb1491e6c1850f0bf0745c6781ca1085b90959669a006a3222ac

Download Submit
C:\Windows\{8474C992-4F7F-4d3e-B021-48AB649300AA}.exe

Filesize
216KB

MD5
f0e3b6aefba94f5d63e706627cd34f94

SHA1
be620c5f590b8b117e8ca9388b225a86afb5d7a9

SHA256
ad25ca29e664748caa2202b95757f7454d3f76241108e1f3761f30021eda1e0d

SHA512
4c0a975f0334586c8c1318ee8ed7221602566a4eab8e08e8140c16d3ff9ee3a6470b39b50b1c8ba4ddedf9a243f6a27758c0815f88a2cbda48361903cbfb4fd5

Download Submit
C:\Windows\{A41DF7B6-11DD-4ab1-90CE-8161F9FE4DC7}.exe

Filesize
216KB

MD5
3d9ca2fd7391b3377c91e22c922f53b1

SHA1
3bb7a28182b683e603440d4249f5718e5312be1d

SHA256
a87add3bfba9249373c3e6bd1ee6f30503338a36d73d62f0dfafb6b7ecbb9ecd

SHA512
cb321d8dc31230c7bb008ead863310a80fdbcbcba5bf8557496cc1c7c0e8c2b851556df5656f80a0879f74afdef1f59c4847b4bfe4fc6376574e383db1c92312

Download Submit
C:\Windows\{A6238F31-D052-47e5-B66B-C08F77945D22}.exe

Filesize
216KB

MD5
0c8a50c1b3b29ac5c323ab9e14568f9e

SHA1
f8b3bf1a526cf9a6b691853fb50e47d06a46d4e8

SHA256
e6f12489ad237706b8af7a19687692b8c308699615910022a609bceca1dba086

SHA512
19ffb8afbaaf6e30d3937e4045d645b475ac49e7290c97093f2ed213538f29983febb53d14f1a3fc8722b79fcebb583da9bb64667880b2f874c4acdfca1f9f65

Download Submit
C:\Windows\{CC90715B-E47A-4dda-B505-B9EEF3DB3D1D}.exe

Filesize
216KB

MD5
1dbd6f4d88ab3c35eb691beb4f60002e

SHA1
e4be43493723dc71eb1c5187b6d48c13fda5d59e

SHA256
b891009a8feb341a23f2c74a08575acbf77aa31b487ff0c356302f6ff51e72ed

SHA512
27e4bbc27913024c70a0ee8ea059c6e060579a57855021c6538910a5928415922052e78cefc5618b43ea747e13caed1bf9c41964bb45a6789b5fa880a2f4373b

Download Submit
C:\Windows\{D5BFB26A-469B-4867-92E3-B26050D4C401}.exe

Filesize
216KB

MD5
8e5232c8945055a629738b435c82e83c

SHA1
95faa9bebe55e4c03f87c8f0a63361ff76bc4e65

SHA256
efa008e13fbfa700e2bd7dbcfc23b9a14c5958a8334969af52332edb83cdeaa2

SHA512
bada9b9c8e364e86d124aa78355076bd3625b5a18ca81b264eed8e4388e68a873fb70a6b8a8f0a78013fb1d707fe2f8cf3616056123d50a0374de8a34bc04919

Download Submit
C:\Windows\{E4DCE158-2410-4933-915F-DC2BE66B86C4}.exe

Filesize
216KB

MD5
24ae67038cdceefce095281a47dc5ffb

SHA1
eb90c0b745a5c9ec06b726664a6c85c13ec131ca

SHA256
89f76437d936ed763ac70ec42d53699adf7a4c4d814b682c7968ed78ff1b2773

SHA512
9ad8a3cf00ceb3505c905647d3d96847d52feab4a04eb4ee4ad8ca229bb81a252d9eae5d545398ec140ea0042b6d8e8d07a7ac2b881a74bb919499117cb686e5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads