454d240c0f243f2a493f53fd6401718ee4415ed1ea785620164789d2e41ed2ac

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
Size

216KB
MD5

54d6c3a6b291cef3b0a1e6ced431a459
SHA1

5e986b94d227059a6d6c998e5f862d7c10bd9814
SHA256

454d240c0f243f2a493f53fd6401718ee4415ed1ea785620164789d2e41ed2ac
SHA512

e4a4dd478c26c766152b8a0295584a0cd4e2c5ea7232603034f30003bfad6ee49e646c8900bc0161bc1f82dddaf7143979f344ceb92835629cdc7e28d8deec21
SSDEEP

3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGrlEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral2/files/0x0004000000022d20-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023283-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023140-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023282-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219e9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00020000000219ea-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070f-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0006000000000026-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0005000000000507-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000000026-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03715686-E215-4e80-993B-F3783B050011}\stubpath = "C:\\Windows\\{03715686-E215-4e80-993B-F3783B050011}.exe"	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DA22A94-B401-4ced-9132-E84F260A84B9}\stubpath = "C:\\Windows\\{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe"	{643B4EAB-065C-4e93-914B-6781F1494834}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FAA451B-4788-4341-A74B-2B09D38FEF07}	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}	{03715686-E215-4e80-993B-F3783B050011}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}\stubpath = "C:\\Windows\\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe"	{03715686-E215-4e80-993B-F3783B050011}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E8D263F-E771-43ee-B910-5D216146AB1D}	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E8D263F-E771-43ee-B910-5D216146AB1D}\stubpath = "C:\\Windows\\{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe"	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}\stubpath = "C:\\Windows\\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe"	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{643B4EAB-065C-4e93-914B-6781F1494834}	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{643B4EAB-065C-4e93-914B-6781F1494834}\stubpath = "C:\\Windows\\{643B4EAB-065C-4e93-914B-6781F1494834}.exe"	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0E75438-EE26-47f2-8995-054DE56B47F6}\stubpath = "C:\\Windows\\{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe"	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FAA451B-4788-4341-A74B-2B09D38FEF07}\stubpath = "C:\\Windows\\{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe"	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}\stubpath = "C:\\Windows\\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe"	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DA22A94-B401-4ced-9132-E84F260A84B9}	{643B4EAB-065C-4e93-914B-6781F1494834}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0E75438-EE26-47f2-8995-054DE56B47F6}	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}\stubpath = "C:\\Windows\\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe"	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}\stubpath = "C:\\Windows\\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe"	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03715686-E215-4e80-993B-F3783B050011}	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe

Executes dropped EXE 11 IoCs

pid	Process
408	{03715686-E215-4e80-993B-F3783B050011}.exe
1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe
3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe
876	{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
File created	C:\Windows\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
File created	C:\Windows\{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
File created	C:\Windows\{643B4EAB-065C-4e93-914B-6781F1494834}.exe	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
File created	C:\Windows\{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	{643B4EAB-065C-4e93-914B-6781F1494834}.exe
File created	C:\Windows\{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
File created	C:\Windows\{03715686-E215-4e80-993B-F3783B050011}.exe	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
File created	C:\Windows\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	{03715686-E215-4e80-993B-F3783B050011}.exe
File created	C:\Windows\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
File created	C:\Windows\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
File created	C:\Windows\{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
Token: SeIncBasePriorityPrivilege	408	{03715686-E215-4e80-993B-F3783B050011}.exe
Token: SeIncBasePriorityPrivilege	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
Token: SeIncBasePriorityPrivilege	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
Token: SeIncBasePriorityPrivilege	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
Token: SeIncBasePriorityPrivilege	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
Token: SeIncBasePriorityPrivilege	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe
Token: SeIncBasePriorityPrivilege	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
Token: SeIncBasePriorityPrivilege	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
Token: SeIncBasePriorityPrivilege	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
Token: SeIncBasePriorityPrivilege	2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 408	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	99
PID 4032 wrote to memory of 408	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	99
PID 4032 wrote to memory of 408	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	99
PID 4032 wrote to memory of 4924	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	100
PID 4032 wrote to memory of 4924	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	100
PID 4032 wrote to memory of 4924	4032	2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe	100
PID 408 wrote to memory of 1476	408	{03715686-E215-4e80-993B-F3783B050011}.exe	105
PID 408 wrote to memory of 1476	408	{03715686-E215-4e80-993B-F3783B050011}.exe	105
PID 408 wrote to memory of 1476	408	{03715686-E215-4e80-993B-F3783B050011}.exe	105
PID 408 wrote to memory of 4236	408	{03715686-E215-4e80-993B-F3783B050011}.exe	106
PID 408 wrote to memory of 4236	408	{03715686-E215-4e80-993B-F3783B050011}.exe	106
PID 408 wrote to memory of 4236	408	{03715686-E215-4e80-993B-F3783B050011}.exe	106
PID 1476 wrote to memory of 2756	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	108
PID 1476 wrote to memory of 2756	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	108
PID 1476 wrote to memory of 2756	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	108
PID 1476 wrote to memory of 640	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	109
PID 1476 wrote to memory of 640	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	109
PID 1476 wrote to memory of 640	1476	{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe	109
PID 2756 wrote to memory of 4348	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	110
PID 2756 wrote to memory of 4348	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	110
PID 2756 wrote to memory of 4348	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	110
PID 2756 wrote to memory of 2300	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	111
PID 2756 wrote to memory of 2300	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	111
PID 2756 wrote to memory of 2300	2756	{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe	111
PID 4348 wrote to memory of 1932	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	112
PID 4348 wrote to memory of 1932	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	112
PID 4348 wrote to memory of 1932	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	112
PID 4348 wrote to memory of 1384	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	113
PID 4348 wrote to memory of 1384	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	113
PID 4348 wrote to memory of 1384	4348	{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe	113
PID 1932 wrote to memory of 1712	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	114
PID 1932 wrote to memory of 1712	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	114
PID 1932 wrote to memory of 1712	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	114
PID 1932 wrote to memory of 1648	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	115
PID 1932 wrote to memory of 1648	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	115
PID 1932 wrote to memory of 1648	1932	{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe	115
PID 1712 wrote to memory of 3808	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	116
PID 1712 wrote to memory of 3808	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	116
PID 1712 wrote to memory of 3808	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	116
PID 1712 wrote to memory of 4312	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	117
PID 1712 wrote to memory of 4312	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	117
PID 1712 wrote to memory of 4312	1712	{643B4EAB-065C-4e93-914B-6781F1494834}.exe	117
PID 3808 wrote to memory of 532	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	118
PID 3808 wrote to memory of 532	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	118
PID 3808 wrote to memory of 532	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	118
PID 3808 wrote to memory of 4632	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	119
PID 3808 wrote to memory of 4632	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	119
PID 3808 wrote to memory of 4632	3808	{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe	119
PID 532 wrote to memory of 908	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	120
PID 532 wrote to memory of 908	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	120
PID 532 wrote to memory of 908	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	120
PID 532 wrote to memory of 1032	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	121
PID 532 wrote to memory of 1032	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	121
PID 532 wrote to memory of 1032	532	{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe	121
PID 908 wrote to memory of 2080	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	122
PID 908 wrote to memory of 2080	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	122
PID 908 wrote to memory of 2080	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	122
PID 908 wrote to memory of 3972	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	123
PID 908 wrote to memory of 3972	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	123
PID 908 wrote to memory of 3972	908	{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe	123
PID 2080 wrote to memory of 876	2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe	124
PID 2080 wrote to memory of 876	2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe	124
PID 2080 wrote to memory of 876	2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe	124
PID 2080 wrote to memory of 3368	2080	{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe	125

C:\Users\Admin\AppData\Local\Temp\2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_54d6c3a6b291cef3b0a1e6ced431a459_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\{03715686-E215-4e80-993B-F3783B050011}.exe
  C:\Windows\{03715686-E215-4e80-993B-F3783B050011}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
    C:\Windows\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
      C:\Windows\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
        
        C:\Windows\{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Windows\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
        
        C:\Windows\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\{643B4EAB-065C-4e93-914B-6781F1494834}.exe
        
        C:\Windows\{643B4EAB-065C-4e93-914B-6781F1494834}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
        
        C:\Windows\{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
        
        C:\Windows\{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
        
        C:\Windows\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe
        
        C:\Windows\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe
        
        C:\Windows\{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe
        12⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1A848~1.EXE > nul
        12⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0EACD~1.EXE > nul
        11⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A0E75~1.EXE > nul
        10⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4DA22~1.EXE > nul
        9⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{643B4~1.EXE > nul
        8⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EF15~1.EXE > nul
        7⤵
        
        PID:1648
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E8D2~1.EXE > nul
        6⤵
        
        PID:1384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D29CA~1.EXE > nul
        5⤵
        
        PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{92AEC~1.EXE > nul
      4⤵
      PID:640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{03715~1.EXE > nul
    3⤵
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{03715686-E215-4e80-993B-F3783B050011}.exe

Filesize
216KB

MD5
4eb34d424955e090aab5a5f8305bfe31

SHA1
aea1ccb4beed7acda6d379c1ae2c2465ec98b1de

SHA256
8c2ce655b6095c2c689a47d281ab500ec0ed380f50d92855ff6453acfbb485e1

SHA512
f65a73b4b7bd28abd2816a30cb772788e940e33906c47e8353d95a282af3eb2aefb9c448a4487dd4ea381cb1755740c68dc572a56c7a5ce4419fbb6ce2ded355

Download Submit
C:\Windows\{0EACDB64-0C5E-4730-AA9B-7801EBA6B85D}.exe

Filesize
216KB

MD5
1c18ebb104778ecfba5ef59b9b6bf603

SHA1
3adc2200078a598d62a48be81526313df4dd6f72

SHA256
3b8c6ceb380232f0b6584c8e3546e1f0648e7c4fb70bf1b1933adc8e44472389

SHA512
3ca7119ff6b5594601a961b975a81febfbcfacea6e7554c473eba2d29b9fd9fe2ed1f408fcd8dca571eb37822265bcdfea26205ab3d02a9e7b126b62dc79b968

Download Submit
C:\Windows\{1A8485F5-3433-4bb2-B031-3D517E07BE6D}.exe

Filesize
216KB

MD5
5404c2b50a6f4600a5584ce729e541de

SHA1
e7571140dc33f9a02414737041fc9ef68ce4e526

SHA256
c1f0eb317047f1cfd404ad8c4242f69bf2327b9c191021035f2ae0b5b760cedb

SHA512
9ba2dc14c612185756cc3ca23f95d7dfd2e7baafccfeddf3065094d919cb57e56bbed10a277df6134584afa14d93992470e84b6d50f74c26048dc2faedc00a07

Download Submit
C:\Windows\{1FAA451B-4788-4341-A74B-2B09D38FEF07}.exe

Filesize
216KB

MD5
2ed9a23d829d5fe1ea05b40497216358

SHA1
5d47fe8b5f884d22de17cb9cbc5d014fdd3b0f42

SHA256
f86d151e89c75d8d66442124807ee811ce4344a955dfca7d66cd22d15b0e9fe4

SHA512
e36d90c646829db6abcfabf7fda79c635c0454482b0d41df2ba451e59ca373bc0c8ea86ab9de659989f0d82794385f6df17b23aa093e051fe8f6cd1c788bed7f

Download Submit
C:\Windows\{4DA22A94-B401-4ced-9132-E84F260A84B9}.exe

Filesize
216KB

MD5
2bcec0f56d0405e3cb750cbf98b553a7

SHA1
9cffea3714a82122ab24add52b1dfdaf04dfab4c

SHA256
00e4676b7626d483bdf9d42c0bd8a508327a45cc26b76fb02a50935da7829550

SHA512
a86902d7de424d8e819d4628717a42aa94c7b6959344f206d3aa1cdc1bfc8d5c8d9327c049534a045b5f53fb0f7e08e8857cc5b3223d7ebbae5394c9e0309a0d

Download Submit
C:\Windows\{643B4EAB-065C-4e93-914B-6781F1494834}.exe

Filesize
216KB

MD5
6b7f1637ba4ed2ff70b4ae7fce9d0e3a

SHA1
8d8236b8ef889777be4ae6895cf8b1e6edbaed01

SHA256
4d37186f0df87658963d45260bb5bbd136b565ea4147d1c027103fb7ffbc37c9

SHA512
dbe06fd1db29f6329ced3cf032ead57e47a807fb4762dc72df5963c25ab0eddde72fe4678a2d41ba4f298bd4a784d375e747bc98016774a776bf729df38a2f29

Download Submit
C:\Windows\{6EF15C1E-D9AC-42c5-A7C9-4CF1F1E1130C}.exe

Filesize
216KB

MD5
19e170c036b3cb148c51265cee371391

SHA1
4e7a80a52ef7dabdb5abe5d6c9093a6e08846645

SHA256
89f58e6bb37e4491779d283f70d1f653f98db1d35c25b66bdb68a2836e862eff

SHA512
7172c6f0aee2532c7dff6969ac45177c3963922654bb54bd1637f8fa0d0c4d0abe641755f6ac33002b10d6baeca728d909fc7fdfc2025132d5b2723009a4b6f7

Download Submit
C:\Windows\{7E8D263F-E771-43ee-B910-5D216146AB1D}.exe

Filesize
216KB

MD5
49ee6ed14c5c43954e53ee1000fb28f4

SHA1
3846f1c14af7fee5ac37ac6629b440db7fb4c919

SHA256
4e5bbd5ab0068bb78bf734e6e7f201a9720626d8f14357f30b4b3764e189356c

SHA512
8747c8525c11f8989930f48615055bd06c28d5d309a90444eba4547c217601272aa682d284e7db3d7fbf1958ca0d37e5d958e924196bb239c3f3db09b88508e5

Download Submit
C:\Windows\{92AEC0B1-9FF7-4d7e-B968-84CCB244B66A}.exe

Filesize
216KB

MD5
30b29ea2cab054cd97a11d8f6b72d220

SHA1
161f82bfaa439a94e49e611b73dd2928078da927

SHA256
df9f524dd1db0b99bf890d07bb76df24fcb6a8cb08ebf095b7c4b91cd6859612

SHA512
ebc47fca4a3456254fb634b0238f0b398aeed0ce7498cf8fac300bcb725585580a29f4ad1ac0cd38df7ecc0f993b56213655ab9175dd0a0d080853b0793418fb

Download Submit
C:\Windows\{A0E75438-EE26-47f2-8995-054DE56B47F6}.exe

Filesize
216KB

MD5
c608d3f49d8e0012c4c2d610dff93ec9

SHA1
aa91b0bddb59432a04ba72c825cbc46da29b6c75

SHA256
573be9703a0a961bc5a39a33232d38d3f104f581af329fd93e3458d5d8a19d01

SHA512
789bf93fbf2314e9170cb86f0a96290f4537ccf54c9a2d7a035039db6c6dafcb54156198771a3e8c15911bf2161f7448ff3625b145de42c19e623652de2ccde3

Download Submit
C:\Windows\{D29CA4B3-7776-430b-86D8-DD9F50A0E4A5}.exe

Filesize
216KB

MD5
4d8712a075ec272aa9da86dd514d43f7

SHA1
334d5aafbea5b89622fb1abd556d637e447ab63c

SHA256
da0c50616b8a762b3d3b011d33fb35d233a9c1005f344ab790be8c180615947a

SHA512
867a78b56b3e8d103f158ad70c20033e20fc842622e663d976e233e155c30766f147e08b72dff26f14c39717c8e6f58613f54416766af1274f428f2ce18fd72b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads