aebf5805369fca9f8dd91f47ccd00c44fe8a27aa853acf4fefd5ec3304bfbbdb

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Size

372KB
MD5

6f9f5e208dfe22443b65c767fb43d0d3
SHA1

c7ea8004cf48461d7c44be775776c4bd0c720a56
SHA256

aebf5805369fca9f8dd91f47ccd00c44fe8a27aa853acf4fefd5ec3304bfbbdb
SHA512

78e0032cb78789000a9642a8215218a3a50cce62baa92c5b1d03b142c9a5609336ff3e2b47395e496f47747cc3c16ab73f91913c1baeeff92b927aa1465b3412
SSDEEP

3072:CEGh0oclMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEGmlkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012267-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d0000000122d5-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012267-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012267-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f2-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f2-41.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012267-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000000f6f2-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012267-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000000f6f2-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012267-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}\stubpath = "C:\\Windows\\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe"	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}\stubpath = "C:\\Windows\\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe"	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6215179-98FD-49d2-B90D-0EA3783140DE}	{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}	{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6E14E97-B098-4ceb-8407-D545408BCC73}\stubpath = "C:\\Windows\\{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe"	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC067ECE-F912-411b-810E-23700D05461F}\stubpath = "C:\\Windows\\{BC067ECE-F912-411b-810E-23700D05461F}.exe"	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}	{F3068869-9810-4f49-8140-F452C979C0C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D6E14E97-B098-4ceb-8407-D545408BCC73}	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61BCA525-26AE-4153-A378-AD60EB39208F}\stubpath = "C:\\Windows\\{61BCA525-26AE-4153-A378-AD60EB39208F}.exe"	{BC067ECE-F912-411b-810E-23700D05461F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}\stubpath = "C:\\Windows\\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe"	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3068869-9810-4f49-8140-F452C979C0C8}	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F3068869-9810-4f49-8140-F452C979C0C8}\stubpath = "C:\\Windows\\{F3068869-9810-4f49-8140-F452C979C0C8}.exe"	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}\stubpath = "C:\\Windows\\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe"	{F3068869-9810-4f49-8140-F452C979C0C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88B4C9E5-E234-459c-90D0-76CCC90B7432}	{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BC067ECE-F912-411b-810E-23700D05461F}	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{61BCA525-26AE-4153-A378-AD60EB39208F}	{BC067ECE-F912-411b-810E-23700D05461F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{88B4C9E5-E234-459c-90D0-76CCC90B7432}\stubpath = "C:\\Windows\\{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe"	{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F6215179-98FD-49d2-B90D-0EA3783140DE}\stubpath = "C:\\Windows\\{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe"	{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}\stubpath = "C:\\Windows\\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe"	{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe

Executes dropped EXE 11 IoCs

pid	Process
2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
948	{BC067ECE-F912-411b-810E-23700D05461F}.exe
2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe
760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
1020	{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
1632	{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
2056	{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe
2144	{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
File created	C:\Windows\{F3068869-9810-4f49-8140-F452C979C0C8}.exe	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
File created	C:\Windows\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	{F3068869-9810-4f49-8140-F452C979C0C8}.exe
File created	C:\Windows\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
File created	C:\Windows\{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe	{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
File created	C:\Windows\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
File created	C:\Windows\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
File created	C:\Windows\{BC067ECE-F912-411b-810E-23700D05461F}.exe	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
File created	C:\Windows\{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	{BC067ECE-F912-411b-810E-23700D05461F}.exe
File created	C:\Windows\{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe	{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
File created	C:\Windows\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe	{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
Token: SeIncBasePriorityPrivilege	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
Token: SeIncBasePriorityPrivilege	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
Token: SeIncBasePriorityPrivilege	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe
Token: SeIncBasePriorityPrivilege	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
Token: SeIncBasePriorityPrivilege	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe
Token: SeIncBasePriorityPrivilege	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
Token: SeIncBasePriorityPrivilege	1020	{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
Token: SeIncBasePriorityPrivilege	1632	{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
Token: SeIncBasePriorityPrivilege	2056	{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2284	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	28
PID 1648 wrote to memory of 2284	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	28
PID 1648 wrote to memory of 2284	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	28
PID 1648 wrote to memory of 2284	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	28
PID 1648 wrote to memory of 2656	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	29
PID 1648 wrote to memory of 2656	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	29
PID 1648 wrote to memory of 2656	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	29
PID 1648 wrote to memory of 2656	1648	2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe	29
PID 2284 wrote to memory of 1120	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	30
PID 2284 wrote to memory of 1120	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	30
PID 2284 wrote to memory of 1120	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	30
PID 2284 wrote to memory of 1120	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	30
PID 2284 wrote to memory of 2484	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	31
PID 2284 wrote to memory of 2484	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	31
PID 2284 wrote to memory of 2484	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	31
PID 2284 wrote to memory of 2484	2284	{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe	31
PID 1120 wrote to memory of 2588	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	32
PID 1120 wrote to memory of 2588	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	32
PID 1120 wrote to memory of 2588	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	32
PID 1120 wrote to memory of 2588	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	32
PID 1120 wrote to memory of 2668	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	33
PID 1120 wrote to memory of 2668	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	33
PID 1120 wrote to memory of 2668	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	33
PID 1120 wrote to memory of 2668	1120	{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe	33
PID 2588 wrote to memory of 948	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	36
PID 2588 wrote to memory of 948	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	36
PID 2588 wrote to memory of 948	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	36
PID 2588 wrote to memory of 948	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	36
PID 2588 wrote to memory of 2748	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	37
PID 2588 wrote to memory of 2748	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	37
PID 2588 wrote to memory of 2748	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	37
PID 2588 wrote to memory of 2748	2588	{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe	37
PID 948 wrote to memory of 2776	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	38
PID 948 wrote to memory of 2776	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	38
PID 948 wrote to memory of 2776	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	38
PID 948 wrote to memory of 2776	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	38
PID 948 wrote to memory of 2812	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	39
PID 948 wrote to memory of 2812	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	39
PID 948 wrote to memory of 2812	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	39
PID 948 wrote to memory of 2812	948	{BC067ECE-F912-411b-810E-23700D05461F}.exe	39
PID 2776 wrote to memory of 1676	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	40
PID 2776 wrote to memory of 1676	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	40
PID 2776 wrote to memory of 1676	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	40
PID 2776 wrote to memory of 1676	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	40
PID 2776 wrote to memory of 1384	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	41
PID 2776 wrote to memory of 1384	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	41
PID 2776 wrote to memory of 1384	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	41
PID 2776 wrote to memory of 1384	2776	{61BCA525-26AE-4153-A378-AD60EB39208F}.exe	41
PID 1676 wrote to memory of 760	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	42
PID 1676 wrote to memory of 760	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	42
PID 1676 wrote to memory of 760	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	42
PID 1676 wrote to memory of 760	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	42
PID 1676 wrote to memory of 808	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	43
PID 1676 wrote to memory of 808	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	43
PID 1676 wrote to memory of 808	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	43
PID 1676 wrote to memory of 808	1676	{F3068869-9810-4f49-8140-F452C979C0C8}.exe	43
PID 760 wrote to memory of 1020	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	44
PID 760 wrote to memory of 1020	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	44
PID 760 wrote to memory of 1020	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	44
PID 760 wrote to memory of 1020	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	44
PID 760 wrote to memory of 896	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	45
PID 760 wrote to memory of 896	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	45
PID 760 wrote to memory of 896	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	45
PID 760 wrote to memory of 896	760	{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_6f9f5e208dfe22443b65c767fb43d0d3_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
  C:\Windows\{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
    C:\Windows\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
      C:\Windows\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Windows\{BC067ECE-F912-411b-810E-23700D05461F}.exe
        
        C:\Windows\{BC067ECE-F912-411b-810E-23700D05461F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:948
      - C:\Windows\{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
        
        C:\Windows\{61BCA525-26AE-4153-A378-AD60EB39208F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\{F3068869-9810-4f49-8140-F452C979C0C8}.exe
        
        C:\Windows\{F3068869-9810-4f49-8140-F452C979C0C8}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
        
        C:\Windows\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
        
        C:\Windows\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
        
        C:\Windows\{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Windows\{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe
        
        C:\Windows\{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe
        
        C:\Windows\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe
        12⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F6215~1.EXE > nul
        12⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88B4C~1.EXE > nul
        11⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC0BA~1.EXE > nul
        10⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8A69A~1.EXE > nul
        9⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3068~1.EXE > nul
        8⤵
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61BCA~1.EXE > nul
        7⤵
        
        PID:1384
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BC067~1.EXE > nul
        6⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E8B01~1.EXE > nul
        5⤵
        
        PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{014AB~1.EXE > nul
      4⤵
      PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D6E14~1.EXE > nul
    3⤵
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{014ABC1E-BFB2-4efb-9E7D-AA9D7696AA20}.exe

Filesize
372KB

MD5
1fd8f940084e116c80a8db29130f92e5

SHA1
0f706b5b0fbb5dfafb24c488e0265dfbb7a28b44

SHA256
a895890edbba02486b1e5771ceeaf2dcbcb2b17b355f9125acc12b0741ddc7a3

SHA512
c87839746fb916708451054e6941aba1980d7e4d55fde4eefda30efc1b39291005d0d15852286bf779de3c8a743db4f8851b469e8413b1ed00d9a7a92c747de0

Download Submit
C:\Windows\{5BAA8CD7-E3FB-44f0-8386-F8D069361CCA}.exe

Filesize
372KB

MD5
5b92923b065b3cdfce094c27ecccc285

SHA1
7003b142dcbaef2eb628a9c99dee9d282765c885

SHA256
599eb1dc51bbba1b8d7e66a59393ce5934b1c07a33290cdf0b6c1c800621934f

SHA512
b2b11273ea831e25366a6d8539ff3873ca655e74f909b9397657982412d147d10c257103b0f030fc049c862aba710752590167cc478c9d9c9af836435802e569

Download Submit
C:\Windows\{61BCA525-26AE-4153-A378-AD60EB39208F}.exe

Filesize
372KB

MD5
09fe5a9bb152ef0545954237cfb4bc9a

SHA1
da2b7ceaf82e400df9cf4f5daeff8dcd0a19af88

SHA256
272aa0db9036f480f1898c969283dd9f11e820c69ef084411df20bb84e57560c

SHA512
80b64636771fcefcfe8549afe4660265ff9f5e6ccee9dde6a32bdf883779009dbda6f54d0cd3ca8d6dac60b3a9293b2ebe874b9b2d772bbbc0c9aa70b225e393

Download Submit
C:\Windows\{88B4C9E5-E234-459c-90D0-76CCC90B7432}.exe

Filesize
372KB

MD5
968876da1feef493c4a077049c26e28a

SHA1
2417add94c9ecc28c4a8497f82ef54438d5a67cc

SHA256
2fedda1ccc8d6085dc5fda6f1412b278c9a1b05619464c85880889f9965c36bd

SHA512
cc05f7e81cd2dd18f945804ae81b3f569105c30646ed5cc2051d3c792eda32b77e177723eef4498d5991965df17ae6b68d2c8dbe24ceea99f000725efdd0e137

Download Submit
C:\Windows\{8A69A1BB-80A4-4dc3-81DA-86DCDE667249}.exe

Filesize
372KB

MD5
bbc94bf9c5f308cfdbbe0f82876a977a

SHA1
69c066a5cac58055eb00c574c77b8966a5740294

SHA256
47fdacf54160c17f81dab948d8e00eba077b468ab69a3d120019d7474927ad12

SHA512
587806a7157b27ecf64146ef5b9b15ef14be92bcf54a9d207018c89d7cc97954072f4909763eda5261beaccf832df18debf9265e96c08d35e88e0a6904c57a87

Download Submit
C:\Windows\{BC067ECE-F912-411b-810E-23700D05461F}.exe

Filesize
372KB

MD5
f57f3b943c86d4a68ab988d0c9b83718

SHA1
c0220f2326ab758f0716b67442d1888818a84ec8

SHA256
0a325f343c6dc4f92cb5afe487bbab82d32dab19c7c17ef9014a21fb5bada872

SHA512
e60f1cc36377ad123858b45e5de9a803ab3e53fbfac998cce53e2b7f51062e0d5509754dfe5815ce2919bfaacdea04756c9e6cec7c40adf94021c63040391e23

Download Submit
C:\Windows\{BC0BADB4-8123-48c9-ABCD-A259CA29AA3F}.exe

Filesize
372KB

MD5
6f6ca2bedc969e32747790eeefd81511

SHA1
ab65bdea007b18052ec33429705e6e1245f7fd36

SHA256
a0ea44f14b230f0ff8063d3a80eea3e4de28c29e7bffa0f67b03294cca248e41

SHA512
25ea683abcaf658291b9c9c22c9ab491728a98ce0f23d6db9315efeff08de0c59f782b0fe2f4b4acdaeaaca74348e76001d6b99ca31e381d08cc64627b79ce12

Download Submit
C:\Windows\{D6E14E97-B098-4ceb-8407-D545408BCC73}.exe

Filesize
372KB

MD5
9b7f28f3fb04cdfe5cc91b6abccbb62f

SHA1
3ac72c7ee4158ff6523cd54dcc9ae27ae6704144

SHA256
77b284274248671632d2b8c727189aa26a363710b01e9a3cf637ff57d412412a

SHA512
fc5ce4dca5caf68a6a48d7b50f06036766384593d89301aaab4151b525565480c7e5aca618974ebfb79276041d677e9ce0d7fa98c5cdce86f672ca220fc67c4f

Download Submit
C:\Windows\{E8B01324-221B-4a6b-9C2F-AB72CB560ACA}.exe

Filesize
372KB

MD5
392bb4f44291b754cbc1e41e9197bca7

SHA1
78353adf8a1de88eca66554fbf92506bbde48112

SHA256
46f446b1bf205b391f219d5bfc7c7e721ec1426f661392c7d56412edee326849

SHA512
4ebd70a8132d447785e96444ac0f46b1449b153cd31eb928aaec2ba2baac02dc32657c504c46c1ddcf951c88c46f42007838c3922e7f134137443e30ed208b18

Download Submit
C:\Windows\{F3068869-9810-4f49-8140-F452C979C0C8}.exe

Filesize
372KB

MD5
0a1d47c532b7a6e1974ba4e5c72f8f50

SHA1
095799748d9e5526f1198887fc78881f59f2afcc

SHA256
58e9ce444b6db0d5c062577f425ed06d6b6b8ac2c83ea92eb9d5995207ca92f7

SHA512
f246d19612c078aaf0734abfe360a4b7b7551ca1c60390bc532cd1def2bbd1bcf6762c6533cef2655ba3d4b223d31fbc91663cb1895f4fa28473e25119704ccb

Download Submit
C:\Windows\{F3068869-9810-4f49-8140-F452C979C0C8}.exe

Filesize
231KB

MD5
f6180b7c5fd33dc33f843b4716236279

SHA1
337d5f2f9b816ac23c7e120ffdc5fb847d219c38

SHA256
ff2324f39a26805a6dc9c4c5b15ac8006ad5b2218747abbe6707c9d46234a425

SHA512
8a3b3537bd7f919e779adaa4c66fc3aa0c0f4ad110faabdd0564de43a8474e77f13d6bb4c33b095ba597fd820154a5de2916b4befaf9da14b247c5acdd2cfc66

Download Submit
C:\Windows\{F6215179-98FD-49d2-B90D-0EA3783140DE}.exe

Filesize
372KB

MD5
36034daf82218f5091c7525455f1de81

SHA1
8e596c9fcaa70cb02c36be9371221b2419e234b3

SHA256
318b4529547f689435c28ce314496c0e8b6a638e4927939743933050e85cef3e

SHA512
4796bff252564ceeafe6b8666e648d2ed5adc7b7ac6995690c78e6b31dee07d7483526cd7bc4f2833912d6597e5c7b142a6b055445ace28a75aba314f1fa4afd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads