5b4da516600e2177af80cb0efca3f000d5ff9f14c394f3e7fa503249260f476e

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Size

216KB
MD5

7e3f6179f25cd650baaf5e291ec9fcfc
SHA1

e0f367cca860e96d525a9a4321496b50eac70a03
SHA256

5b4da516600e2177af80cb0efca3f000d5ff9f14c394f3e7fa503249260f476e
SHA512

c71499bf3509e161134db9b682442a3700158239f1d1a597c26f423d687177e539dfb92f33f49f13a07ff0223035769fd041ba044bb1779b832e824cc2e5548e
SSDEEP

3072:jEGh0o9l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGvlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012260-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000016d75-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000300000000b1f3-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000000b1f3-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000000b1f3-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000000b1f3-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000000b1f3-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}\stubpath = "C:\\Windows\\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe"	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04E7EE6B-40C8-48ce-9295-6D97287697B1}\stubpath = "C:\\Windows\\{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe"	{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}\stubpath = "C:\\Windows\\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe"	{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32C5266D-359C-4123-ACA6-CF47F12E08DF}\stubpath = "C:\\Windows\\{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe"	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}\stubpath = "C:\\Windows\\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe"	{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}\stubpath = "C:\\Windows\\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe"	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEC23B99-4B0E-4639-B4C3-65279952A739}	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}\stubpath = "C:\\Windows\\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe"	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85B460BA-C289-450f-87EA-01E5BE35BD90}\stubpath = "C:\\Windows\\{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe"	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25390697-7799-4a92-B55D-80A336DBD8EE}	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04E7EE6B-40C8-48ce-9295-6D97287697B1}	{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32C5266D-359C-4123-ACA6-CF47F12E08DF}	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEC23B99-4B0E-4639-B4C3-65279952A739}\stubpath = "C:\\Windows\\{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe"	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}\stubpath = "C:\\Windows\\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe"	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85B460BA-C289-450f-87EA-01E5BE35BD90}	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25390697-7799-4a92-B55D-80A336DBD8EE}\stubpath = "C:\\Windows\\{25390697-7799-4a92-B55D-80A336DBD8EE}.exe"	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}	{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}	{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe

Deletes itself 1 IoCs

pid	Process
2168	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
840	{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
1244	{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
2036	{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe
2024	{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
File created	C:\Windows\{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
File created	C:\Windows\{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
File created	C:\Windows\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
File created	C:\Windows\{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
File created	C:\Windows\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe	{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
File created	C:\Windows\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
File created	C:\Windows\{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
File created	C:\Windows\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
File created	C:\Windows\{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe	{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
File created	C:\Windows\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe	{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
Token: SeIncBasePriorityPrivilege	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
Token: SeIncBasePriorityPrivilege	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
Token: SeIncBasePriorityPrivilege	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
Token: SeIncBasePriorityPrivilege	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
Token: SeIncBasePriorityPrivilege	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
Token: SeIncBasePriorityPrivilege	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
Token: SeIncBasePriorityPrivilege	840	{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
Token: SeIncBasePriorityPrivilege	1244	{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
Token: SeIncBasePriorityPrivilege	2036	{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3032	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	28
PID 2088 wrote to memory of 3032	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	28
PID 2088 wrote to memory of 3032	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	28
PID 2088 wrote to memory of 3032	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	28
PID 2088 wrote to memory of 2168	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	29
PID 2088 wrote to memory of 2168	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	29
PID 2088 wrote to memory of 2168	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	29
PID 2088 wrote to memory of 2168	2088	2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe	29
PID 3032 wrote to memory of 2708	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	30
PID 3032 wrote to memory of 2708	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	30
PID 3032 wrote to memory of 2708	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	30
PID 3032 wrote to memory of 2708	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	30
PID 3032 wrote to memory of 2884	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	31
PID 3032 wrote to memory of 2884	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	31
PID 3032 wrote to memory of 2884	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	31
PID 3032 wrote to memory of 2884	3032	{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe	31
PID 2708 wrote to memory of 2460	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	34
PID 2708 wrote to memory of 2460	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	34
PID 2708 wrote to memory of 2460	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	34
PID 2708 wrote to memory of 2460	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	34
PID 2708 wrote to memory of 2972	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	35
PID 2708 wrote to memory of 2972	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	35
PID 2708 wrote to memory of 2972	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	35
PID 2708 wrote to memory of 2972	2708	{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe	35
PID 2460 wrote to memory of 2456	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	36
PID 2460 wrote to memory of 2456	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	36
PID 2460 wrote to memory of 2456	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	36
PID 2460 wrote to memory of 2456	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	36
PID 2460 wrote to memory of 700	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	37
PID 2460 wrote to memory of 700	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	37
PID 2460 wrote to memory of 700	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	37
PID 2460 wrote to memory of 700	2460	{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe	37
PID 2456 wrote to memory of 1048	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	38
PID 2456 wrote to memory of 1048	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	38
PID 2456 wrote to memory of 1048	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	38
PID 2456 wrote to memory of 1048	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	38
PID 2456 wrote to memory of 2792	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	39
PID 2456 wrote to memory of 2792	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	39
PID 2456 wrote to memory of 2792	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	39
PID 2456 wrote to memory of 2792	2456	{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe	39
PID 1048 wrote to memory of 2860	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	40
PID 1048 wrote to memory of 2860	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	40
PID 1048 wrote to memory of 2860	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	40
PID 1048 wrote to memory of 2860	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	40
PID 1048 wrote to memory of 2432	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	41
PID 1048 wrote to memory of 2432	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	41
PID 1048 wrote to memory of 2432	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	41
PID 1048 wrote to memory of 2432	1048	{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe	41
PID 2860 wrote to memory of 1548	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	42
PID 2860 wrote to memory of 1548	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	42
PID 2860 wrote to memory of 1548	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	42
PID 2860 wrote to memory of 1548	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	42
PID 2860 wrote to memory of 2496	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	43
PID 2860 wrote to memory of 2496	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	43
PID 2860 wrote to memory of 2496	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	43
PID 2860 wrote to memory of 2496	2860	{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe	43
PID 1548 wrote to memory of 840	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	44
PID 1548 wrote to memory of 840	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	44
PID 1548 wrote to memory of 840	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	44
PID 1548 wrote to memory of 840	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	44
PID 1548 wrote to memory of 2756	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	45
PID 1548 wrote to memory of 2756	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	45
PID 1548 wrote to memory of 2756	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	45
PID 1548 wrote to memory of 2756	1548	{25390697-7799-4a92-B55D-80A336DBD8EE}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_7e3f6179f25cd650baaf5e291ec9fcfc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
  C:\Windows\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
    C:\Windows\{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
      C:\Windows\{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
        
        C:\Windows\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Windows\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
        
        C:\Windows\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
        
        C:\Windows\{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
        
        C:\Windows\{25390697-7799-4a92-B55D-80A336DBD8EE}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
        
        C:\Windows\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
        
        C:\Windows\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe
        
        C:\Windows\{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe
        
        C:\Windows\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe
        12⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{04E7E~1.EXE > nul
        12⤵
        
        PID:768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4CBD5~1.EXE > nul
        11⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BD00A~1.EXE > nul
        10⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25390~1.EXE > nul
        9⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85B46~1.EXE > nul
        8⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{47FEB~1.EXE > nul
        7⤵
        
        PID:2432
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EF28F~1.EXE > nul
        6⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FEC23~1.EXE > nul
        5⤵
        
        PID:700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{32C52~1.EXE > nul
      4⤵
      PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E4B96~1.EXE > nul
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{04E7EE6B-40C8-48ce-9295-6D97287697B1}.exe

Filesize
216KB

MD5
c31668b0158dbee199f82f439818dc21

SHA1
07089a37c119fe74e13d6dfef137e200a3ae55de

SHA256
6aab81bc4a40911e93040bffb9b991f52c765dd760283e6d48f08f98a94f6769

SHA512
c9fb8dbd71a09af128af0d8bcd69a12f77067fdc701cbf7aa0907b713c0444366258e55cdbef336c82d08d00d0e4b3eee701b455caa6c8a6825c995bb6cae3cf

Download Submit
C:\Windows\{25390697-7799-4a92-B55D-80A336DBD8EE}.exe

Filesize
216KB

MD5
3eda274e01e2e3152a32c9c4f3def823

SHA1
078f763ff5ce43598a6757e60a13dd32e6826f8a

SHA256
6ffbca1a0262344603ee5b3d45662d50634567fae1f9625442bc8dbdca46b08c

SHA512
5881d636913db1f40f999d39f8227fbc0ff870ff996bc0d566b6b7469a3855b6e704b75cc88861316155531c37dc020741cac30bf584f6d575ea8862194e91d1

Download Submit
C:\Windows\{32C5266D-359C-4123-ACA6-CF47F12E08DF}.exe

Filesize
216KB

MD5
7f37e1c8e45c1fa231bf4f31846ff10d

SHA1
47380ad2952ebefcde6ae5d334ee06bc581cff1f

SHA256
bbd2ce85cd96bfbc3952a3cd96813a4ab553a8780cd6978836e80b009b4b10a3

SHA512
a13114931e2a436757c497090e1327fa6c555891749b6b26b5021cde6291030b539ed93fad5d53ca3334f7585281dd44edec65b95b547401268b7eef4cac5008

Download Submit
C:\Windows\{47FEB9E4-290F-4240-B837-FEB2AE2C5481}.exe

Filesize
216KB

MD5
5949b18016a93b1316ccbf0a5d492454

SHA1
1031314484b0f78b00bf36fe31c4b24eb4347a02

SHA256
837d638a0576f2e76cfb83465f97c9326815604962fdb4bcf7ddb1934b5c664f

SHA512
80cf864921a8907e2335f945d1a95ee90bdca5f48919236dd5d59e7c69b3676490ddf250185784bbeda8992b293bfa7f7c70acee00312069a3a2f37b2f07a28d

Download Submit
C:\Windows\{4CBD534C-8A5B-449f-A1CC-B9932D388A45}.exe

Filesize
216KB

MD5
d172ae1af3d6915d25bf91f219b5202d

SHA1
45be536417ee57e744210cf128f3ab91d58c97c3

SHA256
7f876fe2fa59054e1b66747f82ace5d82e3b0db16f8dcd7fd4ac3b8b9fd609fd

SHA512
24793c24b1274f0ff733e974983356b20f57995f025678da44bc50224ba520cbc1684dd226baff5eea28e772070392b1513f95e0d218d381c3b86b36cb6ad24b

Download Submit
C:\Windows\{85B460BA-C289-450f-87EA-01E5BE35BD90}.exe

Filesize
216KB

MD5
e7c815744c19e6297fe9dfe61b7338d9

SHA1
90305780cd1799873d5b22ba48e8b541bf49b642

SHA256
f80a213b8c1deb48c70aee1e7974a17aebe68e60ea9d23a71f5a6b7a4aa581e4

SHA512
7ddad430b1491d27d70d1a16f0177e3fa524c4c4605b52089f8065b6fd220b69dca4fe9456ea46eadf5548d3d4033242e29f42fada70a13c4e3fdee206018762

Download Submit
C:\Windows\{B17849F9-980C-4bcc-A2E1-A5921B25A5F6}.exe

Filesize
216KB

MD5
c22f42941512ec06c691cc00c1b343d2

SHA1
b3bc1c89759a62fb724a9e1f04fbe0ac7f30a31b

SHA256
1568362a81fbf349cd70495c4183893ad3fa1e0ae9e8fa9be042289440da44a0

SHA512
ff92b0f798684701f8f78ec710164072ca9b4188f1591aeabff1f7875627ca51942f36ebd87034fbaa7209c74390ac39f8216400bd32763f86cb9e862ca708e0

Download Submit
C:\Windows\{BD00A846-4FCD-4fc5-BA6E-575BB7D9A6E6}.exe

Filesize
216KB

MD5
b0494414e77011aaf1a7942c1bd78e1e

SHA1
836c93995db379ec674defbdaefa973f2b4c2a10

SHA256
3c04b1cf621976225f1221194f48470dfabc256965d7fbb6745b8cc9f0624b2e

SHA512
84c1b3ecc9fbc0e2765bbf51948d83d38c629f8c81e4906228bd6d9fa2d08fcfda641ee1eca67d9248a2e4410a8989f44484ac0b52b314d959e5ca3231028f4b

Download Submit
C:\Windows\{E4B96C76-722B-4f9c-8ED3-D770614A9E83}.exe

Filesize
216KB

MD5
4cb0141859eff45150b124c2adea05ce

SHA1
53734bc3c77f8efc05bcceabc31cbde6dec0bf97

SHA256
d541c5b643693a86865161b16f027fa9ab750db10840bdee5cbea9d71fda813b

SHA512
90875d9eb552938016493de94185d6aa30b5cf6999751c43f093ec752e896d14ca33a4318108a937542ca27b46f90385862511b1922299d0c53cbde8dbeee5e5

Download Submit
C:\Windows\{EF28F245-0202-4f51-BDD5-70D93AE48CFD}.exe

Filesize
216KB

MD5
ea24498bbe44f788588976a7bb2f1d4b

SHA1
ff375d2de0d9ee89241bbea6f01aa3430f5db60b

SHA256
007c55763a7557fa2a0da75a131f6ff5a92fd25767768d34a83ee67e6683d730

SHA512
1028c2673f47cf82a486d092f9117cdcef6f3de9ebb9304d70f117eac9cad8da4d27fe0b19711be2a6cc69b4f7814ad0747cf9227930fd5bc8d3f7ec05114690

Download Submit
C:\Windows\{FEC23B99-4B0E-4639-B4C3-65279952A739}.exe

Filesize
216KB

MD5
07c369d64256e27d17b64b1a79120bff

SHA1
47721f7f55542525c7889f6e81d549263d642fd8

SHA256
81d2059f1eafa20351c76031fe2c2b7be32d14f82d8ebc30398ded03507cc2dc

SHA512
eff8f10bfedd90c2b61fa1e99c08198acce9f670d407bb7846fad8969160a7a2b9f7e54761012ad61c412d32cd9b86767f396a6d31f75141fa1076bbd96b7270

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads