cf53726f2a21abfd10b84bddfed1dfb5e2e01317dbfe69103c3946461e0fea74

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
Size

372KB
MD5

a21859979d0c14c0b578e0d17d02e1a0
SHA1

37aa9875b3265454ee2741c6ed61d2829a57c12d
SHA256

cf53726f2a21abfd10b84bddfed1dfb5e2e01317dbfe69103c3946461e0fea74
SHA512

7d797a6745dc9eac9d596facf1191460f790dc187fcc52a10dc4894953908a50cbcb3f11f244fb1373f4f0d4e1fc0c39d377b70d45c4fdc17fedb9429519a2d2
SSDEEP

3072:CEGh0o7lMOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBfM:CEG9lkOe2MUVg3vTeKcAEciTBqr3

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001466c-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000000f680-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000014738-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000000f680-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000014738-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000000f680-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000014738-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001200000000f680-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000014a55-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000014a94-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}\stubpath = "C:\\Windows\\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe"	{4970F132-596C-4e47-9661-CED35FCF084E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C0F2122-769E-498d-BDDE-7A62F04F510F}	{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{03156149-AF2C-4dc2-B4B2-D111BD485C05}\stubpath = "C:\\Windows\\{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe"	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBB9CC29-5E52-453e-834B-70695819D0A1}\stubpath = "C:\\Windows\\{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe"	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}\stubpath = "C:\\Windows\\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe"	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBB9CC29-5E52-453e-834B-70695819D0A1}	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4970F132-596C-4e47-9661-CED35FCF084E}	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}	{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4970F132-596C-4e47-9661-CED35FCF084E}\stubpath = "C:\\Windows\\{4970F132-596C-4e47-9661-CED35FCF084E}.exe"	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5110D4E2-C617-4a6b-BE81-C6353C03169D}	{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}\stubpath = "C:\\Windows\\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe"	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}	{4970F132-596C-4e47-9661-CED35FCF084E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}\stubpath = "C:\\Windows\\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe"	{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7C0F2122-769E-498d-BDDE-7A62F04F510F}\stubpath = "C:\\Windows\\{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe"	{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{03156149-AF2C-4dc2-B4B2-D111BD485C05}	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}\stubpath = "C:\\Windows\\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe"	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBA85607-C63B-4c40-82FD-D985167BA393}	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBA85607-C63B-4c40-82FD-D985167BA393}\stubpath = "C:\\Windows\\{DBA85607-C63B-4c40-82FD-D985167BA393}.exe"	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5110D4E2-C617-4a6b-BE81-C6353C03169D}\stubpath = "C:\\Windows\\{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe"	{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe

Deletes itself 1 IoCs

pid	Process
1640	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe
1648	{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
1580	{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
2264	{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe
2920	{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
File created	C:\Windows\{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
File created	C:\Windows\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
File created	C:\Windows\{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
File created	C:\Windows\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
File created	C:\Windows\{4970F132-596C-4e47-9661-CED35FCF084E}.exe	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
File created	C:\Windows\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe	{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
File created	C:\Windows\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
File created	C:\Windows\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe	{4970F132-596C-4e47-9661-CED35FCF084E}.exe
File created	C:\Windows\{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe	{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
File created	C:\Windows\{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe	{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
Token: SeIncBasePriorityPrivilege	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
Token: SeIncBasePriorityPrivilege	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
Token: SeIncBasePriorityPrivilege	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
Token: SeIncBasePriorityPrivilege	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
Token: SeIncBasePriorityPrivilege	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
Token: SeIncBasePriorityPrivilege	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe
Token: SeIncBasePriorityPrivilege	1648	{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
Token: SeIncBasePriorityPrivilege	1580	{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
Token: SeIncBasePriorityPrivilege	2264	{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3012	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	28
PID 1612 wrote to memory of 3012	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	28
PID 1612 wrote to memory of 3012	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	28
PID 1612 wrote to memory of 3012	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	28
PID 1612 wrote to memory of 1640	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	29
PID 1612 wrote to memory of 1640	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	29
PID 1612 wrote to memory of 1640	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	29
PID 1612 wrote to memory of 1640	1612	2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe	29
PID 3012 wrote to memory of 2692	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	32
PID 3012 wrote to memory of 2692	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	32
PID 3012 wrote to memory of 2692	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	32
PID 3012 wrote to memory of 2692	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	32
PID 3012 wrote to memory of 2452	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	33
PID 3012 wrote to memory of 2452	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	33
PID 3012 wrote to memory of 2452	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	33
PID 3012 wrote to memory of 2452	3012	{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe	33
PID 2692 wrote to memory of 2420	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	34
PID 2692 wrote to memory of 2420	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	34
PID 2692 wrote to memory of 2420	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	34
PID 2692 wrote to memory of 2420	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	34
PID 2692 wrote to memory of 2488	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	35
PID 2692 wrote to memory of 2488	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	35
PID 2692 wrote to memory of 2488	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	35
PID 2692 wrote to memory of 2488	2692	{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe	35
PID 2420 wrote to memory of 3016	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	36
PID 2420 wrote to memory of 3016	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	36
PID 2420 wrote to memory of 3016	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	36
PID 2420 wrote to memory of 3016	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	36
PID 2420 wrote to memory of 1060	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	37
PID 2420 wrote to memory of 1060	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	37
PID 2420 wrote to memory of 1060	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	37
PID 2420 wrote to memory of 1060	2420	{DBA85607-C63B-4c40-82FD-D985167BA393}.exe	37
PID 3016 wrote to memory of 572	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	38
PID 3016 wrote to memory of 572	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	38
PID 3016 wrote to memory of 572	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	38
PID 3016 wrote to memory of 572	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	38
PID 3016 wrote to memory of 1112	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	39
PID 3016 wrote to memory of 1112	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	39
PID 3016 wrote to memory of 1112	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	39
PID 3016 wrote to memory of 1112	3016	{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe	39
PID 572 wrote to memory of 2608	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	40
PID 572 wrote to memory of 2608	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	40
PID 572 wrote to memory of 2608	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	40
PID 572 wrote to memory of 2608	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	40
PID 572 wrote to memory of 2728	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	41
PID 572 wrote to memory of 2728	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	41
PID 572 wrote to memory of 2728	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	41
PID 572 wrote to memory of 2728	572	{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe	41
PID 2608 wrote to memory of 2052	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	42
PID 2608 wrote to memory of 2052	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	42
PID 2608 wrote to memory of 2052	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	42
PID 2608 wrote to memory of 2052	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	42
PID 2608 wrote to memory of 1796	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	43
PID 2608 wrote to memory of 1796	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	43
PID 2608 wrote to memory of 1796	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	43
PID 2608 wrote to memory of 1796	2608	{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe	43
PID 2052 wrote to memory of 1648	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	44
PID 2052 wrote to memory of 1648	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	44
PID 2052 wrote to memory of 1648	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	44
PID 2052 wrote to memory of 1648	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	44
PID 2052 wrote to memory of 2256	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	45
PID 2052 wrote to memory of 2256	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	45
PID 2052 wrote to memory of 2256	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	45
PID 2052 wrote to memory of 2256	2052	{4970F132-596C-4e47-9661-CED35FCF084E}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_a21859979d0c14c0b578e0d17d02e1a0_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
  C:\Windows\{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
    C:\Windows\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
      C:\Windows\{DBA85607-C63B-4c40-82FD-D985167BA393}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
        
        C:\Windows\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
      - C:\Windows\{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
        
        C:\Windows\{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
        
        C:\Windows\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\{4970F132-596C-4e47-9661-CED35FCF084E}.exe
        
        C:\Windows\{4970F132-596C-4e47-9661-CED35FCF084E}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
        
        C:\Windows\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
        
        C:\Windows\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
        
        C:\Windows\{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe
        
        C:\Windows\{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe
        
        C:\Windows\{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe
        12⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7C0F2~1.EXE > nul
        12⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B17DE~1.EXE > nul
        11⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{514A3~1.EXE > nul
        10⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4970F~1.EXE > nul
        9⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0FBE4~1.EXE > nul
        8⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBB9C~1.EXE > nul
        7⤵
        
        PID:2728
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4B8EB~1.EXE > nul
        6⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBA85~1.EXE > nul
        5⤵
        
        PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1ECE1~1.EXE > nul
      4⤵
      PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{03156~1.EXE > nul
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{03156149-AF2C-4dc2-B4B2-D111BD485C05}.exe

Filesize
372KB

MD5
32b9075c3b752d61d23aef4381fd9beb

SHA1
f0b718b189880e690b1216d2a4063ca095570aa5

SHA256
90e4e0a20ef5cea33b8235c80deaedcd5bfc4de4bd00e071f87a4897a4f87bea

SHA512
8bc91521d1f60b2a4e0793233b773e753cda85004fcbaa2704d6cf4484157ba207b3fb0ae18b4c5321e6ffc1afa0253696624e03a6dbed118bc7e656debd8a54

Download Submit
C:\Windows\{0FBE46F1-73D6-4a84-9F33-22CD3928C227}.exe

Filesize
372KB

MD5
db006b12c1601ba80e1aab6c0213c5ad

SHA1
f688c6210481630fa7a5c8f323d3042384b1169f

SHA256
edeea820c64b2e0a4b14464b97c6ea2b87fa3ead57e1efa542d5865f8cd05f2d

SHA512
de4ff07c9d790974d9d2a9e1797202fdd2973b467d5c42c0dd74fc16466976ab7b62b3b4f296ffdffbb4a09732c4d23b7e2d8fe821315ddeb9f431ab3c4082db

Download Submit
C:\Windows\{1ECE1C8D-FA57-4ade-9027-E00DF794905F}.exe

Filesize
372KB

MD5
6bee65a7e612f9e6c06ab516115efd21

SHA1
7c4903c20b65bb404e96c7e2f3e6f9ad38dc61f2

SHA256
be4f225780a02442f10a25bb3c1adbeb3afdead7bf978318c197ba06b2a95d51

SHA512
8380461f01e8b176144d0ab1f1ea14462eb44389ab26f6fd63c1e92e077caed0cf9a8b070498b21dd652cae3bbfaea189fb724c9a5c3effe3f5ea35a0212c9c2

Download Submit
C:\Windows\{4970F132-596C-4e47-9661-CED35FCF084E}.exe

Filesize
372KB

MD5
1d497c3a27a07f27149f729aecb146e7

SHA1
224b08e8197a1f83b791fdd057f5678705c23bbd

SHA256
f09d2666cb9cc3790511c69fea0b9e86e7cfb4d0ae96f355dfbdf133ae704488

SHA512
19beaa4e780ed92ed948ab52684f25f24fe6983946932310d313cca5d1526c906708dcb34a833d54b7fdc9d94b556860013871441ec2439a83cb8306ad23e900

Download Submit
C:\Windows\{4B8EBF7E-4492-4d0c-BB83-0C91161BBF00}.exe

Filesize
372KB

MD5
d7c9a3b2871b0dc8cd7b2565c6532946

SHA1
a02b8edf8c30f8000dd86bf5ce59b8d856e6905f

SHA256
6e06f0e3e594e461db6b1aa84bab3df5f48c94ffdb2ac3625ee5bdfddea2871a

SHA512
100623e5d9ab24111c6c45a2754b1c128102d1fa436a306f1aeb4fe2e7514537c38b5458a2197eb4e2d873e18cc06d34376c31e7769b7c07976aeb274737cdee

Download Submit
C:\Windows\{5110D4E2-C617-4a6b-BE81-C6353C03169D}.exe

Filesize
372KB

MD5
5450b995d8cb69e14876ee82b6e6814d

SHA1
94a02808553962343c05cc69dc1616116ca99f81

SHA256
32e5415e65a364b55769a5309825bb9b596e481b4a1067c9680e5984410d1bb3

SHA512
e5af8ad9a7bfe5c58877057843db7ef6dd9b21907d563937358acd82c0632ab04e31276f1fe070c6b9161cbdb19924ce58042845499b1355b253d734277fb893

Download Submit
C:\Windows\{514A3013-97D4-4279-B71B-FF07FFD5C9EB}.exe

Filesize
372KB

MD5
14fe44e7e30c16244e84bfb5890ac98a

SHA1
0849b306d50a6b3b989d7dcf899c0a6676ee4324

SHA256
c298aebf5dd1ca9fd7fdc19dfdd85399b14a7eaff8ba3c73d266f8e9949a135a

SHA512
73bc086e080f5f4967baac85f5d10f2e6f3b1c19cc0ef94c30933fc7f8831f1ab115931a9a6c6b1595f439b8ce34c795991f795c3f3d3cd861d605aec71d4c91

Download Submit
C:\Windows\{7C0F2122-769E-498d-BDDE-7A62F04F510F}.exe

Filesize
372KB

MD5
84584cf5e5a4c6f74a605b745a5af276

SHA1
088c18071f05522a916924ed08758879058a91f9

SHA256
2442b6e4e465760425c3f39229cd70349c0cb249568b2358b2fc10374eef5420

SHA512
eda9a26c4fee0816a4f7065cf4475b8b385eceb1bb64d96e1d3ad90010d779d7157c105beba214f2ac580bcac69fc8d95aa1fc4d0404a13e7bfdfefd5ae40368

Download Submit
C:\Windows\{B17DEE02-7230-452c-BB3D-FE4F5C8E5FDD}.exe

Filesize
372KB

MD5
57dd740006fe998ac467da15f58d5ec3

SHA1
dee1ee071de718c4a2486f1ba6c90479cd9a9245

SHA256
d4977bd20f200381275fb1d613820c58a7dcef4815feb4ef9a74019cc4d5bf93

SHA512
ddd63c86d5554623fbfa7f21de1404a799404ba6823522d03664ff624428a88c0c6050dc69d6d1b481e0a02726370d8dfaef1daee8daf665aab657104f66e957

Download Submit
C:\Windows\{DBA85607-C63B-4c40-82FD-D985167BA393}.exe

Filesize
372KB

MD5
a176868b2032313640c02791139a1031

SHA1
e7d4aa696a0a277c59ad6d7da5869c5f84391e9e

SHA256
21c43b334f5db0213abd9dec0a1f5486e052db324bd6368104772b5f1401ae40

SHA512
7ea0e37bf0224ac46f21df4f29b72dc2c9b746582f933e36b75bbd21365d12fb9e6dd123c6e7fdaeda26a4b7047bd6efce023daef9f56350f58ad5d2c9a086f9

Download Submit
C:\Windows\{DBB9CC29-5E52-453e-834B-70695819D0A1}.exe

Filesize
372KB

MD5
db6a69fdc09bb1c55e23e4efcc91ca16

SHA1
1222158a2f67e61c8e962c402f3ee46b68cd4a62

SHA256
7a0f11356365ca6858c2cf3dfdbd290cc957cde2ea4e8eb2fac800ce1954762b

SHA512
5d485f64917624c5a10c34eeae96decc39f39bff421f9fee81526f2aebdfc847b6b4f2233f82ad54b2b167a3a8abc5cb485a120e0af2396505f60853cac26cce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads