d65ec313306f57c1f4fad92126a950e4f1a1f548e48c8a16fb5522df3030d528

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
Size

372KB
MD5

3de38eaa232261602b1553b86025cb6e
SHA1

f80c5cdc53e6d76933c0201868711144ae2149ad
SHA256

d65ec313306f57c1f4fad92126a950e4f1a1f548e48c8a16fb5522df3030d528
SHA512

c2e9bd29a9337312b9973c11d00ad4e58d97a471037c514918575c35213282454e8b5e886da8b0717578c372fbb02fd0a5f5cc1a137b11be94cd9896c114a9f9
SSDEEP

3072:CEGh0o3lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGllkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x00090000000155ed-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000155f7-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a0000000155ed-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000015c6b-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000155ed-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000155ed-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-62.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000155ed-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}	{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}\stubpath = "C:\\Windows\\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe"	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}\stubpath = "C:\\Windows\\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe"	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53CD93ED-71A5-4da4-891A-08B2A802193D}	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53CD93ED-71A5-4da4-891A-08B2A802193D}\stubpath = "C:\\Windows\\{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe"	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}\stubpath = "C:\\Windows\\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe"	{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}\stubpath = "C:\\Windows\\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe"	{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826A4923-12EF-4809-ACD3-6EB7A443C23F}	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}	{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}	{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}\stubpath = "C:\\Windows\\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe"	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}\stubpath = "C:\\Windows\\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe"	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}\stubpath = "C:\\Windows\\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe"	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}\stubpath = "C:\\Windows\\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe"	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}\stubpath = "C:\\Windows\\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe"	{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826A4923-12EF-4809-ACD3-6EB7A443C23F}\stubpath = "C:\\Windows\\{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe"	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe

Deletes itself 1 IoCs

pid	Process
2868	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
2988	{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
2264	{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
1164	{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
844	{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe	{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
File created	C:\Windows\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe	{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
File created	C:\Windows\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
File created	C:\Windows\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
File created	C:\Windows\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
File created	C:\Windows\{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
File created	C:\Windows\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe	{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
File created	C:\Windows\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
File created	C:\Windows\{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
File created	C:\Windows\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
File created	C:\Windows\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
Token: SeIncBasePriorityPrivilege	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
Token: SeIncBasePriorityPrivilege	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
Token: SeIncBasePriorityPrivilege	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
Token: SeIncBasePriorityPrivilege	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
Token: SeIncBasePriorityPrivilege	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
Token: SeIncBasePriorityPrivilege	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
Token: SeIncBasePriorityPrivilege	2988	{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
Token: SeIncBasePriorityPrivilege	2264	{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
Token: SeIncBasePriorityPrivilege	1164	{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1756	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	28
PID 2232 wrote to memory of 1756	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	28
PID 2232 wrote to memory of 1756	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	28
PID 2232 wrote to memory of 1756	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	28
PID 2232 wrote to memory of 2868	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	29
PID 2232 wrote to memory of 2868	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	29
PID 2232 wrote to memory of 2868	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	29
PID 2232 wrote to memory of 2868	2232	2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe	29
PID 1756 wrote to memory of 2624	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	30
PID 1756 wrote to memory of 2624	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	30
PID 1756 wrote to memory of 2624	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	30
PID 1756 wrote to memory of 2624	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	30
PID 1756 wrote to memory of 2480	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	31
PID 1756 wrote to memory of 2480	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	31
PID 1756 wrote to memory of 2480	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	31
PID 1756 wrote to memory of 2480	1756	{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe	31
PID 2624 wrote to memory of 2748	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	32
PID 2624 wrote to memory of 2748	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	32
PID 2624 wrote to memory of 2748	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	32
PID 2624 wrote to memory of 2748	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	32
PID 2624 wrote to memory of 2608	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	33
PID 2624 wrote to memory of 2608	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	33
PID 2624 wrote to memory of 2608	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	33
PID 2624 wrote to memory of 2608	2624	{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe	33
PID 2748 wrote to memory of 2212	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	36
PID 2748 wrote to memory of 2212	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	36
PID 2748 wrote to memory of 2212	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	36
PID 2748 wrote to memory of 2212	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	36
PID 2748 wrote to memory of 1956	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	37
PID 2748 wrote to memory of 1956	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	37
PID 2748 wrote to memory of 1956	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	37
PID 2748 wrote to memory of 1956	2748	{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe	37
PID 2212 wrote to memory of 1768	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	38
PID 2212 wrote to memory of 1768	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	38
PID 2212 wrote to memory of 1768	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	38
PID 2212 wrote to memory of 1768	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	38
PID 2212 wrote to memory of 808	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	39
PID 2212 wrote to memory of 808	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	39
PID 2212 wrote to memory of 808	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	39
PID 2212 wrote to memory of 808	2212	{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe	39
PID 1768 wrote to memory of 2460	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	40
PID 1768 wrote to memory of 2460	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	40
PID 1768 wrote to memory of 2460	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	40
PID 1768 wrote to memory of 2460	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	40
PID 1768 wrote to memory of 1912	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	41
PID 1768 wrote to memory of 1912	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	41
PID 1768 wrote to memory of 1912	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	41
PID 1768 wrote to memory of 1912	1768	{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe	41
PID 2460 wrote to memory of 2808	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	42
PID 2460 wrote to memory of 2808	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	42
PID 2460 wrote to memory of 2808	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	42
PID 2460 wrote to memory of 2808	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	42
PID 2460 wrote to memory of 1324	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	43
PID 2460 wrote to memory of 1324	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	43
PID 2460 wrote to memory of 1324	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	43
PID 2460 wrote to memory of 1324	2460	{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe	43
PID 2808 wrote to memory of 2988	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	44
PID 2808 wrote to memory of 2988	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	44
PID 2808 wrote to memory of 2988	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	44
PID 2808 wrote to memory of 2988	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	44
PID 2808 wrote to memory of 2860	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	45
PID 2808 wrote to memory of 2860	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	45
PID 2808 wrote to memory of 2860	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	45
PID 2808 wrote to memory of 2860	2808	{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_3de38eaa232261602b1553b86025cb6e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
  C:\Windows\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
    C:\Windows\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
      C:\Windows\{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
        
        C:\Windows\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
      - C:\Windows\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
        
        C:\Windows\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
        
        C:\Windows\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
        
        C:\Windows\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
        
        C:\Windows\{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
        
        C:\Windows\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
        
        C:\Windows\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe
        
        C:\Windows\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe
        12⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0A94~1.EXE > nul
        12⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{01AA3~1.EXE > nul
        11⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53CD9~1.EXE > nul
        10⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6E578~1.EXE > nul
        9⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C42D~1.EXE > nul
        8⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BF99~1.EXE > nul
        7⤵
        
        PID:1912
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7BD83~1.EXE > nul
        6⤵
        
        PID:808
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{826A4~1.EXE > nul
        5⤵
        
        PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{ED3F7~1.EXE > nul
      4⤵
      PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5F621~1.EXE > nul
    3⤵
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe

Filesize
372KB

MD5
5489daba747f3f69fa04cd11e1df0fbb

SHA1
e98a6b1c2594df0d59c1711d1f8b9dab940ad9d4

SHA256
3ad0dc50f950b2b9debac40a4f4493a9d0000e7b6adea6ff0164f3986f5a3952

SHA512
dd378359ac99fb9c7176f1371450ff64df040e167e60f69be18b37896126611129b58759b50e16f8966772cce345fb02ac44d63693c313f8883d087f944f9879

Download Submit
C:\Windows\{01AA3EE1-0A40-443d-BB4B-A99B6DEBA669}.exe

Filesize
64KB

MD5
07114844c18e73bf772532367529092a

SHA1
1262ba9849cb969f6b352ad943a4a02f0960133d

SHA256
f02272ced9ebe26e4acbd98a3bd376ad3b20d96363ba313f389d4544014e5f4a

SHA512
63c37a08d75de86d33e54f11d5357afb79c6df9dcb47687330afb6cbe2a47cdc003d02679fde7a3c9fed56539911331111d3cec391e1aca390150935078a003b

Download Submit
C:\Windows\{3BF996D7-0F32-40f8-85D1-C61DEE4DADA6}.exe

Filesize
372KB

MD5
910a7db67a83d03e3df5fdbeeaa2f52f

SHA1
6453f0269aa367247644f01a800699967a91b681

SHA256
3060befae5209eea9efe138a86fb3c7c961c067c42136fa0504ee104243ce87c

SHA512
d67a3f47c76cd728f8fef5f7054fe879da405eadc12217ca24637ebb68ad71cd38167a996975de006a0f1519e5a20af827e1ab50cc50702a32b546d4b925987e

Download Submit
C:\Windows\{3C42DECE-3C3A-4c09-92ED-B57DB632F231}.exe

Filesize
372KB

MD5
035a9b7be613af2aa67570ca01c50528

SHA1
b44c3c920430368aa00179845fa92ae31f10a8d8

SHA256
acd801e8fd0cd55dd5416a494809ce60f74d191339ba70db13f18b4349edf990

SHA512
8348e43fe07feb494026e444c2005ec2d724acd91d27c3d6118315598661365d2653f4842baa0ece7147ea60d83e9c81e2bacb8634830e07795541fb13f1770b

Download Submit
C:\Windows\{53CD93ED-71A5-4da4-891A-08B2A802193D}.exe

Filesize
372KB

MD5
4b69474795a6d9a361e8c56c629cf778

SHA1
3082d1a6a19fba3f4914b16583947c6ca9a88050

SHA256
aa7a38c7397027616564183d68cdd6a00b78d8c21cee4f00a4a27f5218fb4935

SHA512
8f37dbd215d0ea13136f59c01e4fa9c344296b065565865591b31175507e10e3f5bdfac58fe88e958652838aef16a488afee074945835aec8d2d2fa912421526

Download Submit
C:\Windows\{5F621AD5-D16E-4561-BB43-22B0C6E91C8B}.exe

Filesize
372KB

MD5
b82939cb2b8773b971f09e56a6588f35

SHA1
35310e1a5abaad689d63e557ceb87dd0d521040a

SHA256
e44092b54712f0deb28f2bbf411684ff46a6ef4260996775435e04672804d531

SHA512
f849b382f5d95b842b0531e800d6c477aacf846b29d44dd3189e05751fbb83f41bccbcf25264776cd0c7eac07198772b11a860c455b4ec4210a5fa5394d92a49

Download Submit
C:\Windows\{65FA90D5-3D6F-4f20-8937-F499877C2A1C}.exe

Filesize
372KB

MD5
96ba61f1a57ce2e9db9aa25561e004a4

SHA1
8a8d065a499a63ca0669c556b6eccce14e92a45b

SHA256
f81d55a27dc707a40368da2556cd27a2a4014836989edc50145260f541440948

SHA512
4bf3c8308083487f99f6928d55ab7bc814179300d2c7fdf140905da1e63007f4af8c257148e615c87d5b2635296cb935c56cc021a8bcadeba23e9c0b88c86410

Download Submit
C:\Windows\{6E578BB3-7900-4cc7-B9A7-5849EC3B98AA}.exe

Filesize
372KB

MD5
1019889d88d817549b0a3f6ee3c4031f

SHA1
b3ea8610d378f7d31716596b945998e1cf003a14

SHA256
34656a1f56321695ab406e93d4333e98d6a9dfa596f3f9b325557712ba4ad22e

SHA512
0168c01e3dd840e79f546919a4fc304d0203722c62e6c5f5665d6ffa9c117bd6c9344aab8e3acafc25ea28ec6d25c58266acca5c53c2b65c204f3aa59c70431a

Download Submit
C:\Windows\{7BD83284-F1D7-49c0-AE2D-82F35F04F1DE}.exe

Filesize
372KB

MD5
a8dc8636f02190f30570e74930ba2003

SHA1
b02970f31da6d0454eab8fc299a05695985bfc59

SHA256
b8e35a508e457cd022893556d634dfed9cf5f03c111ce0afae1c5b09b713d307

SHA512
0cccec642b9798c892a8c0b09e383fdbd2bfa16c0bc6c6711a250e5dca93d629fbec5e0eb582f0f5019ad37338cde1b4114287763b3aebadb8ea59960e296f5a

Download Submit
C:\Windows\{826A4923-12EF-4809-ACD3-6EB7A443C23F}.exe

Filesize
372KB

MD5
dfe7a1c1eb61ca5f31626f4844c023b3

SHA1
de68b56e4d4b1d7267ce25a7bc7a3d8f3208842f

SHA256
4bffe70992c5b62275e0f70fbc40f87ae2b6b963c517b255c712e788b292a695

SHA512
e7ff2e177eede78bb772b9d10cd6769196de93221520f65a7c23d0e21687bfd962a7c62f4f8578b6d7f35b24fafc26cee13e9b211575e49c0d93318e4825fbec

Download Submit
C:\Windows\{E0A9491A-6D44-4f2e-B6A1-3152488FCA2E}.exe

Filesize
372KB

MD5
e17220505af375e3971ca34675c6aa2f

SHA1
0c30e7af553dd7985c018cb849435d27366f685e

SHA256
f611fe484e2151a93f93b5a15de7ef09ab3e5584286ee57fe49b6354875e4e0b

SHA512
f49ba6e9e676cceb968148607e84b292ce73965d72377abfe060cf629c3807ea8783af2dd2de8468aa509703fca189a428d2ee5ba7e35ad0e4ddf85e41e6b3ba

Download Submit
C:\Windows\{ED3F700A-AD88-40b1-A7AF-3259531EEB8F}.exe

Filesize
372KB

MD5
eeff16c03a0001a35ba46134f0285d64

SHA1
ba9bd4493929a43f29f71cbb49e915269ab94ba3

SHA256
e3134a2e0b8bc5179e5ee4bcf9091999f1833f9aee2db86c0f00585174526cbe

SHA512
e291cf805fa95971d0b87848214f9a945609821250a7eda7f7d7c49a4d0ff0df6c52a310942bf2c0f9351d1535f95dbc676e7f03eac20108cf4b0abc28750dd9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads