073a8465df039c957a56d768259b65fe584c9308b22b4105ae8950cf3c99f8b0

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
Size

408KB
MD5

c493b2d66a57cf630acc524ef58504e7
SHA1

2da5a23222d989e9e77fd3efa8a564824376455d
SHA256

073a8465df039c957a56d768259b65fe584c9308b22b4105ae8950cf3c99f8b0
SHA512

a2218aa2890789bf1c6c9dff138a33ce1665a224185005e8d0b2c89d0cb6406aec543ff2fdea4e3c55d9953937022df6f40f07f4fe4588867e1f30b7d346bff5
SSDEEP

3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGjldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00090000000122be-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014502-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a0000000122be-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00330000000149e1-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122be-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122be-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122be-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8311D298-E30E-4477-B9B0-2898833739CE}\stubpath = "C:\\Windows\\{8311D298-E30E-4477-B9B0-2898833739CE}.exe"	{E4894619-3971-4089-A466-E830F9BAC08D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204EA88B-78D5-47de-8044-55807B7B3C8F}	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{893405C6-2DEE-49f0-A512-FFC803E9662A}	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44CA0325-92BE-45b9-AB92-0FE777B9528E}\stubpath = "C:\\Windows\\{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe"	{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4894619-3971-4089-A466-E830F9BAC08D}	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4894619-3971-4089-A466-E830F9BAC08D}\stubpath = "C:\\Windows\\{E4894619-3971-4089-A466-E830F9BAC08D}.exe"	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8311D298-E30E-4477-B9B0-2898833739CE}	{E4894619-3971-4089-A466-E830F9BAC08D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A795F85-7332-4637-8881-9C0538C2BA21}	{8311D298-E30E-4477-B9B0-2898833739CE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A795F85-7332-4637-8881-9C0538C2BA21}\stubpath = "C:\\Windows\\{4A795F85-7332-4637-8881-9C0538C2BA21}.exe"	{8311D298-E30E-4477-B9B0-2898833739CE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{456D94E2-A823-4fe8-9392-645A6C409E2B}	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{456D94E2-A823-4fe8-9392-645A6C409E2B}\stubpath = "C:\\Windows\\{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe"	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{893FD5CC-852C-4a26-9612-2823EA628C1D}	{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10AB045E-4CF3-457c-905D-9847A8E2841D}\stubpath = "C:\\Windows\\{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe"	{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{204EA88B-78D5-47de-8044-55807B7B3C8F}\stubpath = "C:\\Windows\\{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe"	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7296BD34-FC01-4fed-B325-4F2291F391F3}	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7296BD34-FC01-4fed-B325-4F2291F391F3}\stubpath = "C:\\Windows\\{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe"	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{893405C6-2DEE-49f0-A512-FFC803E9662A}\stubpath = "C:\\Windows\\{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe"	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{893FD5CC-852C-4a26-9612-2823EA628C1D}\stubpath = "C:\\Windows\\{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe"	{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A6BE80C-467F-406c-A48B-A58EE18446DA}	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A6BE80C-467F-406c-A48B-A58EE18446DA}\stubpath = "C:\\Windows\\{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe"	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44CA0325-92BE-45b9-AB92-0FE777B9528E}	{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10AB045E-4CF3-457c-905D-9847A8E2841D}	{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe

Executes dropped EXE 11 IoCs

pid	Process
1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe
2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe
2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
784	{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
1664	{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
268	{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe
2804	{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
File created	C:\Windows\{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
File created	C:\Windows\{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe	{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
File created	C:\Windows\{E4894619-3971-4089-A466-E830F9BAC08D}.exe	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
File created	C:\Windows\{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	{8311D298-E30E-4477-B9B0-2898833739CE}.exe
File created	C:\Windows\{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
File created	C:\Windows\{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe	{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
File created	C:\Windows\{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe	{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe
File created	C:\Windows\{8311D298-E30E-4477-B9B0-2898833739CE}.exe	{E4894619-3971-4089-A466-E830F9BAC08D}.exe
File created	C:\Windows\{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
File created	C:\Windows\{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe
Token: SeIncBasePriorityPrivilege	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe
Token: SeIncBasePriorityPrivilege	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
Token: SeIncBasePriorityPrivilege	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
Token: SeIncBasePriorityPrivilege	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
Token: SeIncBasePriorityPrivilege	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
Token: SeIncBasePriorityPrivilege	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
Token: SeIncBasePriorityPrivilege	784	{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
Token: SeIncBasePriorityPrivilege	1664	{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
Token: SeIncBasePriorityPrivilege	268	{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1560	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	28
PID 1516 wrote to memory of 1560	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	28
PID 1516 wrote to memory of 1560	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	28
PID 1516 wrote to memory of 1560	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	28
PID 1516 wrote to memory of 2544	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	29
PID 1516 wrote to memory of 2544	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	29
PID 1516 wrote to memory of 2544	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	29
PID 1516 wrote to memory of 2544	1516	2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe	29
PID 1560 wrote to memory of 2208	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	30
PID 1560 wrote to memory of 2208	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	30
PID 1560 wrote to memory of 2208	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	30
PID 1560 wrote to memory of 2208	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	30
PID 1560 wrote to memory of 2688	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	31
PID 1560 wrote to memory of 2688	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	31
PID 1560 wrote to memory of 2688	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	31
PID 1560 wrote to memory of 2688	1560	{E4894619-3971-4089-A466-E830F9BAC08D}.exe	31
PID 2208 wrote to memory of 2564	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	32
PID 2208 wrote to memory of 2564	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	32
PID 2208 wrote to memory of 2564	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	32
PID 2208 wrote to memory of 2564	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	32
PID 2208 wrote to memory of 2456	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	33
PID 2208 wrote to memory of 2456	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	33
PID 2208 wrote to memory of 2456	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	33
PID 2208 wrote to memory of 2456	2208	{8311D298-E30E-4477-B9B0-2898833739CE}.exe	33
PID 2564 wrote to memory of 2716	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	36
PID 2564 wrote to memory of 2716	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	36
PID 2564 wrote to memory of 2716	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	36
PID 2564 wrote to memory of 2716	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	36
PID 2564 wrote to memory of 2712	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	37
PID 2564 wrote to memory of 2712	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	37
PID 2564 wrote to memory of 2712	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	37
PID 2564 wrote to memory of 2712	2564	{4A795F85-7332-4637-8881-9C0538C2BA21}.exe	37
PID 2716 wrote to memory of 2788	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	38
PID 2716 wrote to memory of 2788	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	38
PID 2716 wrote to memory of 2788	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	38
PID 2716 wrote to memory of 2788	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	38
PID 2716 wrote to memory of 2820	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	39
PID 2716 wrote to memory of 2820	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	39
PID 2716 wrote to memory of 2820	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	39
PID 2716 wrote to memory of 2820	2716	{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe	39
PID 2788 wrote to memory of 2292	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	40
PID 2788 wrote to memory of 2292	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	40
PID 2788 wrote to memory of 2292	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	40
PID 2788 wrote to memory of 2292	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	40
PID 2788 wrote to memory of 2388	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	41
PID 2788 wrote to memory of 2388	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	41
PID 2788 wrote to memory of 2388	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	41
PID 2788 wrote to memory of 2388	2788	{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe	41
PID 2292 wrote to memory of 1912	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	42
PID 2292 wrote to memory of 1912	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	42
PID 2292 wrote to memory of 1912	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	42
PID 2292 wrote to memory of 1912	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	42
PID 2292 wrote to memory of 2632	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	43
PID 2292 wrote to memory of 2632	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	43
PID 2292 wrote to memory of 2632	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	43
PID 2292 wrote to memory of 2632	2292	{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe	43
PID 1912 wrote to memory of 784	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	44
PID 1912 wrote to memory of 784	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	44
PID 1912 wrote to memory of 784	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	44
PID 1912 wrote to memory of 784	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	44
PID 1912 wrote to memory of 1644	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	45
PID 1912 wrote to memory of 1644	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	45
PID 1912 wrote to memory of 1644	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	45
PID 1912 wrote to memory of 1644	1912	{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_c493b2d66a57cf630acc524ef58504e7_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\{E4894619-3971-4089-A466-E830F9BAC08D}.exe
  C:\Windows\{E4894619-3971-4089-A466-E830F9BAC08D}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\{8311D298-E30E-4477-B9B0-2898833739CE}.exe
    C:\Windows\{8311D298-E30E-4477-B9B0-2898833739CE}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
      C:\Windows\{4A795F85-7332-4637-8881-9C0538C2BA21}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
        
        C:\Windows\{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Windows\{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
        
        C:\Windows\{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
        
        C:\Windows\{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
        
        C:\Windows\{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
        
        C:\Windows\{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
        
        C:\Windows\{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
        
        C:\Windows\{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe
        
        C:\Windows\{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:268
        
        C:\Windows\{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe
        
        C:\Windows\{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe
        12⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44CA0~1.EXE > nul
        12⤵
        
        PID:776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{893FD~1.EXE > nul
        11⤵
        
        PID:868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89340~1.EXE > nul
        10⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5A6BE~1.EXE > nul
        9⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7296B~1.EXE > nul
        8⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{204EA~1.EXE > nul
        7⤵
        
        PID:2388
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{456D9~1.EXE > nul
        6⤵
        
        PID:2820
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A795~1.EXE > nul
        5⤵
        
        PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8311D~1.EXE > nul
      4⤵
      PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E4894~1.EXE > nul
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{10AB045E-4CF3-457c-905D-9847A8E2841D}.exe

Filesize
408KB

MD5
58be7ca6ae93c583205166ad50c1a798

SHA1
bf26c811762501e581d923fbe7c9d068e66df4d0

SHA256
59225c756297e701922a401d66a1a9096c06d0f23c7f89094c2a0a78d9c5c29f

SHA512
212e40bb45c12b6dd3c23c96b4617ae72cb1dc07584a6cfbe9fcdfdfed6c45151dce826c54ad0fc1e02b0461e2fa4b6860e0f936e4b1fb24e2f7553681e569aa

Download Submit
C:\Windows\{204EA88B-78D5-47de-8044-55807B7B3C8F}.exe

Filesize
408KB

MD5
92987e9bd94a01d15d22225b9295854c

SHA1
e538fd2d3a104abe3efb5770661ee99f3b55ab85

SHA256
ec235cf240579fc894618ec0911325588a1b07745f5c64f4ccf9272de8fb21ba

SHA512
aae0e1aa7b07688af616bb3253e924ec7b71c260ac3f9b8bd79491cfd01c8dfcf42ba555d3c46f29b670ba67323455f30aae2fcf45c31f6647504c9bd67957e0

Download Submit
C:\Windows\{44CA0325-92BE-45b9-AB92-0FE777B9528E}.exe

Filesize
408KB

MD5
3ae9eb0da79f95f211e6e7106779498b

SHA1
968ee869a45251070a27069115f7b048d81b5938

SHA256
e39ff00708e75cb00ba2ed36aea41b98fa3a37449eea73eb5f4e9fb7a2822243

SHA512
9424b9d6670859e1587b9428b640a500fa046132d5ce7e0c58e91435d819d8e5f21903cb885128ecf636a75fa2a64baa29ebee4902d5b9b3a2317d4e9b85226e

Download Submit
C:\Windows\{456D94E2-A823-4fe8-9392-645A6C409E2B}.exe

Filesize
408KB

MD5
d0cd30324881ae36286fc2d42ed8fbee

SHA1
2ed6ac558150f873b11d53f287776e1f99b7e935

SHA256
fb003eb0dc573425082f22dfde63c38a54da7f33a1922e6d4de16f5751386e37

SHA512
65217c29d1eeb04e70bf27e2d46d65af4b01d0f494ef6f330103638aed46d3925ff29ac039fd886d70ec70289200bb2546db3a8a24841c685c8b583a0114ca29

Download Submit
C:\Windows\{4A795F85-7332-4637-8881-9C0538C2BA21}.exe

Filesize
408KB

MD5
ffd05fa744e766bd477ca0d21add5d10

SHA1
b4c2374959537fc20c66d261d2312ca5e0b85bb2

SHA256
a771e28c1116d594548b762daedbcadfc9eb1414280c082132dce8114447cc1d

SHA512
74a4591eb76bb31a699b0699be96d49335ef80c19e2493c296f20152c4e429b07b048fd96de290e93e09840414d9db79963c87df5ecdc29dbcda2393e57b648a

Download Submit
C:\Windows\{5A6BE80C-467F-406c-A48B-A58EE18446DA}.exe

Filesize
408KB

MD5
70036be22ace60653b5e7bd108ce0d7c

SHA1
3aa95083547e0c502b4663acde872b905a19dc05

SHA256
29ee3e5c1f58b310f905f14d8005d9de8899bf69c89d35cbeaf840a14cbe7f0c

SHA512
2c5aa89ec72754da3a00a0e4c97035c112285f6da1452e3bfa5527abc0843e3fb03e17e3c9566924b58b35ee31d7e850d864cefe22aad50f9c6af96f7b9de2eb

Download Submit
C:\Windows\{7296BD34-FC01-4fed-B325-4F2291F391F3}.exe

Filesize
408KB

MD5
b78a2d1a566c1d8eb0558a5d46e25b23

SHA1
9bebd6a29e5673bf2160fe89233236e0ecf73fde

SHA256
a47a147d9c45846b6f3fd3dac4bde936f5d9b1f4ebad2b891fcb2e1076d2a9f1

SHA512
3e17c7e9599157d569e77cf7a48aabc7f90d731330243f07e3b196a6e1ee1f9b1d74100a6a5847c2127f4ce2e4fc2c8cb6829d9b6efbf61c63ef5f45ec92b572

Download Submit
C:\Windows\{8311D298-E30E-4477-B9B0-2898833739CE}.exe

Filesize
408KB

MD5
247540af846156c57317303086e6fb0c

SHA1
9aa8ec29b20032980f9693c86300ae36f468ee27

SHA256
8b77f0f41c2faeebda681afda7dfab117fe96b254194543f11ca31576775cca4

SHA512
520452b3906484e64a5bed0b195447bbba4865d326bbe7dd240f77a03155a3cecdd0710fa50c313443befd33f1575cdb59383b545511438b582ef970fa5d32f6

Download Submit
C:\Windows\{893405C6-2DEE-49f0-A512-FFC803E9662A}.exe

Filesize
408KB

MD5
b8816270ecf5b8d41d049ca3c3634de1

SHA1
73d5b9e0fcfc3583f86a98eb99201c8b1af4e440

SHA256
231d5d807b94f0f34c8f9d51c73d090d165e90701e16ddba6e7194391ae352a9

SHA512
a8538825a05a9b2d5b972130f954bb4c3ea832f547b4539593c26de5a795948a9a76b3ce4ae0bdbfb14b64c2b63a6437540092d942285d896c7e03a3cb82f4b3

Download Submit
C:\Windows\{893FD5CC-852C-4a26-9612-2823EA628C1D}.exe

Filesize
408KB

MD5
0418d64374143cbb1f75c6e74a25030a

SHA1
bb3cbc78ef47c79c7cbcd3f8b66ebbab597ea3e0

SHA256
ab969735d2e85884d7baf7b450067ad1d96983afd17b3e1ce5db5d58f7bb134a

SHA512
8c913ea03bc4f8c6056587989ec30973eb28741bb27c841f0d631428f60cf0bfeb289367dfa3eed0007a0adde0bb68146a8d724cbf1df88163ffce73900bbd23

Download Submit
C:\Windows\{E4894619-3971-4089-A466-E830F9BAC08D}.exe

Filesize
408KB

MD5
0f4c00af7c6fab3f9dfd8efe3a25f7bb

SHA1
60610d167cf397fbdd09614b4c0b1feefa6f3b60

SHA256
9f6c334be0e64def0fb182c96f603831ee471f827d485594edda87fe58c60538

SHA512
49e9d763b2b5fd32fa85cd65ed2e7bffbd2643be68dc5b03a8c0976b755fa55793f9775579ac5e33157b61b3f235a79e1f6a9c74a58107ba9ec31ce408a8e679

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads