6f28d4ff665d3fdc8cc7f94f9ddb4043000fb64b0840b1fe55c5801f955830f1

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
Size

180KB
MD5

e78b242572e44fa3a78241de4bcf4637
SHA1

d3fb2372d3178262b38a7a84194b6414db8c931d
SHA256

6f28d4ff665d3fdc8cc7f94f9ddb4043000fb64b0840b1fe55c5801f955830f1
SHA512

6154f2fb9ad617c2fe3aac92de257d82e4a69e149f62e590a5b55ec2dd711ad0dbdb2e05cabcbb65b20d52d90bf4ad892f64fad34867118fbdc572120db254a4
SSDEEP

3072:jEGh0oJlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGjl5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012257-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012342-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012257-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012257-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012257-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012257-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000012257-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1392D73-EA1C-4a7b-919C-555793056DFD}\stubpath = "C:\\Windows\\{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe"	{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}\stubpath = "C:\\Windows\\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe"	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}\stubpath = "C:\\Windows\\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe"	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}\stubpath = "C:\\Windows\\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe"	{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}\stubpath = "C:\\Windows\\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe"	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3810EF2F-B40E-4653-827F-5A243ACAC89B}	{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3810EF2F-B40E-4653-827F-5A243ACAC89B}\stubpath = "C:\\Windows\\{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe"	{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}\stubpath = "C:\\Windows\\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe"	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBEA2765-856B-4850-97E3-60A82CCE0E21}	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}	{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}\stubpath = "C:\\Windows\\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe"	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}\stubpath = "C:\\Windows\\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe"	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBEA2765-856B-4850-97E3-60A82CCE0E21}\stubpath = "C:\\Windows\\{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe"	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}\stubpath = "C:\\Windows\\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe"	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D1392D73-EA1C-4a7b-919C-555793056DFD}	{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe

Deletes itself 1 IoCs

pid	Process
1064	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
2752	{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
1780	{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
2308	{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe
488	{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
File created	C:\Windows\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
File created	C:\Windows\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
File created	C:\Windows\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
File created	C:\Windows\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
File created	C:\Windows\{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe	{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe
File created	C:\Windows\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
File created	C:\Windows\{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
File created	C:\Windows\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
File created	C:\Windows\{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe	{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
File created	C:\Windows\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe	{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
Token: SeIncBasePriorityPrivilege	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
Token: SeIncBasePriorityPrivilege	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
Token: SeIncBasePriorityPrivilege	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
Token: SeIncBasePriorityPrivilege	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
Token: SeIncBasePriorityPrivilege	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
Token: SeIncBasePriorityPrivilege	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
Token: SeIncBasePriorityPrivilege	2752	{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
Token: SeIncBasePriorityPrivilege	1780	{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
Token: SeIncBasePriorityPrivilege	2308	{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2360	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	28
PID 1704 wrote to memory of 2360	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	28
PID 1704 wrote to memory of 2360	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	28
PID 1704 wrote to memory of 2360	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	28
PID 1704 wrote to memory of 1064	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	29
PID 1704 wrote to memory of 1064	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	29
PID 1704 wrote to memory of 1064	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	29
PID 1704 wrote to memory of 1064	1704	2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe	29
PID 2360 wrote to memory of 2652	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	30
PID 2360 wrote to memory of 2652	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	30
PID 2360 wrote to memory of 2652	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	30
PID 2360 wrote to memory of 2652	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	30
PID 2360 wrote to memory of 2588	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	31
PID 2360 wrote to memory of 2588	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	31
PID 2360 wrote to memory of 2588	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	31
PID 2360 wrote to memory of 2588	2360	{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe	31
PID 2652 wrote to memory of 2552	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	32
PID 2652 wrote to memory of 2552	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	32
PID 2652 wrote to memory of 2552	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	32
PID 2652 wrote to memory of 2552	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	32
PID 2652 wrote to memory of 2236	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	33
PID 2652 wrote to memory of 2236	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	33
PID 2652 wrote to memory of 2236	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	33
PID 2652 wrote to memory of 2236	2652	{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe	33
PID 2552 wrote to memory of 2956	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	36
PID 2552 wrote to memory of 2956	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	36
PID 2552 wrote to memory of 2956	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	36
PID 2552 wrote to memory of 2956	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	36
PID 2552 wrote to memory of 2232	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	37
PID 2552 wrote to memory of 2232	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	37
PID 2552 wrote to memory of 2232	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	37
PID 2552 wrote to memory of 2232	2552	{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe	37
PID 2956 wrote to memory of 2756	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	38
PID 2956 wrote to memory of 2756	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	38
PID 2956 wrote to memory of 2756	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	38
PID 2956 wrote to memory of 2756	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	38
PID 2956 wrote to memory of 2940	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	39
PID 2956 wrote to memory of 2940	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	39
PID 2956 wrote to memory of 2940	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	39
PID 2956 wrote to memory of 2940	2956	{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe	39
PID 2756 wrote to memory of 716	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	40
PID 2756 wrote to memory of 716	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	40
PID 2756 wrote to memory of 716	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	40
PID 2756 wrote to memory of 716	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	40
PID 2756 wrote to memory of 2520	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	41
PID 2756 wrote to memory of 2520	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	41
PID 2756 wrote to memory of 2520	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	41
PID 2756 wrote to memory of 2520	2756	{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe	41
PID 716 wrote to memory of 2620	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	42
PID 716 wrote to memory of 2620	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	42
PID 716 wrote to memory of 2620	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	42
PID 716 wrote to memory of 2620	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	42
PID 716 wrote to memory of 1980	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	43
PID 716 wrote to memory of 1980	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	43
PID 716 wrote to memory of 1980	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	43
PID 716 wrote to memory of 1980	716	{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe	43
PID 2620 wrote to memory of 2752	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	44
PID 2620 wrote to memory of 2752	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	44
PID 2620 wrote to memory of 2752	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	44
PID 2620 wrote to memory of 2752	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	44
PID 2620 wrote to memory of 320	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	45
PID 2620 wrote to memory of 320	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	45
PID 2620 wrote to memory of 320	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	45
PID 2620 wrote to memory of 320	2620	{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_e78b242572e44fa3a78241de4bcf4637_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
  C:\Windows\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
    C:\Windows\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
      C:\Windows\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
        
        C:\Windows\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\Windows\{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
        
        C:\Windows\{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
        
        C:\Windows\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
        
        C:\Windows\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
        
        C:\Windows\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
        
        C:\Windows\{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe
        
        C:\Windows\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
        
        C:\Windows\{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe
        
        C:\Windows\{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe
        12⤵
        Executes dropped EXE
        
        PID:488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9D2E6~1.EXE > nul
        12⤵
        
        PID:796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3810E~1.EXE > nul
        11⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{16B3D~1.EXE > nul
        10⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E24B~1.EXE > nul
        9⤵
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4F269~1.EXE > nul
        8⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DBEA2~1.EXE > nul
        7⤵
        
        PID:2520
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{000C5~1.EXE > nul
        6⤵
        
        PID:2940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7C7A~1.EXE > nul
        5⤵
        
        PID:2232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D42F4~1.EXE > nul
      4⤵
      PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{4BD0C~1.EXE > nul
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{000C52BC-F4A7-458e-92DD-35B4EBE5D042}.exe

Filesize
180KB

MD5
0919e786b3e0d3c07ffc114b3746554d

SHA1
a84c7d941dc2687a7299ad307635fd6a3ee06f91

SHA256
1f49d9d9e0938e14ca5c06eed6455dbc2405fe865d118d030e4ef942ad00f133

SHA512
624d7e8cae0cd9189e816374c001aebe1293a3203d6f4072b3d1e7332fe63dd5a312a13156496559cb001515d2a24e132ad19a349d2ccf0933dd83521fbecb9d

Download Submit
C:\Windows\{16B3DF4E-A22A-42e9-9B7F-055617A6F061}.exe

Filesize
180KB

MD5
33bae09a73a51c8b6e4c3b7b7bbdaa51

SHA1
6d6872678f2cfbcab4b3bfd67e1eeed7c12c71ce

SHA256
2cd598e9cb246523925ea60a0b060d4ebed1e5a3e37b6233eaf47b6c2aa13f43

SHA512
f49c6dfe2e770e1efc5fc1ba45e30664c19295df04a3624c524a51266aed434e9943a4a67b3501d8cc8e781119d39cabc30bc5a86c7806b36097b7f67f366846

Download Submit
C:\Windows\{3810EF2F-B40E-4653-827F-5A243ACAC89B}.exe

Filesize
180KB

MD5
1ba557f9df28a351fd81a33bca533c42

SHA1
113eb1556aafda175efe5de597aa4aa362ddd088

SHA256
f3367fc66e24a937049e8344b7ddf0b02fab97ce79e1b4122a5ab3a7abf95ca3

SHA512
de09ad8ffd8a7056da1201749902aab54906b2f308a1479b74cf674c2e5945591472e4d3ca1b5f11c520e04fe16fb460a97b9185476f87118db3edf346532af2

Download Submit
C:\Windows\{3E24B88E-A916-4b98-B028-1FC26AFA99F0}.exe

Filesize
180KB

MD5
cb6744892d0ead3071870ec0ba320c7f

SHA1
a32bd0f4b2a6230e74cfb72ea1836d888367cff7

SHA256
de0cb86df706cdf22acf1e8af931dcc18bff4de2486e253dc018622dd324e66b

SHA512
b1084742a1acb1d5ad8c5bbaddedf9834bc14eaf7632514e3398b4213513b0631be707dde9550ea22eb59242aabeaea0c49d52ec3842993ee340c14954c2c74b

Download Submit
C:\Windows\{4BD0CDE0-D829-475e-BF3C-39D0041A3AD9}.exe

Filesize
180KB

MD5
4d46d2f5f4310d0acdef65d95cc8f160

SHA1
b6a5264b7cf4fb1aaa529d734299ec47e3a277f9

SHA256
12df58c1ced98ff6b80d069bd5e3087c579d5224f5ac23c04391ef303323ff4d

SHA512
b4d55d1723cafb699cd6bc754508d609d601c83c8cafa39ff553ba7538ea74fe0e103e9d82a10bb3b529651b5b8f75e1e0b26840b0de77652af613c3c39fd558

Download Submit
C:\Windows\{4F269B79-48D3-40e8-962D-CF9D9131DEA0}.exe

Filesize
180KB

MD5
90c8d15a6378d8b7f22f7a1040562e72

SHA1
6ba9b1ee0b56faf1c0cda88dcc4e15af13dd74a4

SHA256
2f75f781148bb3aff5c53c2016391528fe0bb6f6ce9d0b0d8c7a0bbeb260cf09

SHA512
2fec8e0df0190d0141f045cf41496c7817ef465e035e3687f40cf5678915552620b56b881d2c96f892815ca4fecfe523ec4379beb0b753565a5e24b338beb6b5

Download Submit
C:\Windows\{9D2E6EC6-F730-4418-B4E1-592D3FE4496D}.exe

Filesize
180KB

MD5
6061dcdf3e2ed1baf2bbe83c9c968a0f

SHA1
9db0fdcf83b38a403fab6802c0bdd5d1ffa7bc19

SHA256
3eb99b575e70e06b157716b3b17d1be694577ce1987b71b21ab73568592d39a9

SHA512
2ecf9f6e82524396148ffdc0fcaca037bf9e75639857cfca611284fb8a8c104e6f89ce87437bbf82c547873461dc4bfb13daa2584e421a74cb76ef84cb1020d0

Download Submit
C:\Windows\{D1392D73-EA1C-4a7b-919C-555793056DFD}.exe

Filesize
180KB

MD5
9f48ec2930c0f1630442609846add677

SHA1
2503f4f4a41ef6bbb6791518845055cd5d2dda1e

SHA256
4122148114e8f58958678861577e0fefea6db30db45d7abe0495e82e82480261

SHA512
51233272e637ebbbe310ac471ae54c26240cd229d89879258c4c2fd7e54b180b4f056e5a73c8f1da0971ec80309d0de0a2556cec363d4cc63f9948bef42fc11e

Download Submit
C:\Windows\{D42F49FE-DB73-4e7b-AF61-25F82AEA3C66}.exe

Filesize
180KB

MD5
ec2f00afdc78f54a21c579654d446a3b

SHA1
448e4a27b8c577375f833f5a7305d110ea75c52a

SHA256
bef481a94f8d19d5354009cd3ea7c93d150d38599402afa7ebc4ddc1d61895ca

SHA512
92510f5470a45223ea30318d86a331a98dad268ee01f41100f656a9cd19ae1ea151f3bf1012123d0868ac54be4719adc19f77969919f18bc3cfaa377c9458112

Download Submit
C:\Windows\{DBEA2765-856B-4850-97E3-60A82CCE0E21}.exe

Filesize
180KB

MD5
390a73af21a172eb61604ee4efb2598d

SHA1
32acfa9e34b1053969820479cfb5b803f5acb586

SHA256
0f4cd7a5cee6f1416b339eb27d6795dc53c819938d233c992301dda5e74635d0

SHA512
66eefabf310de1161fb4dbb4fb52f4694535b25df9b8ca5fca1c20122e589833d2718f0729b5b13ae562c95c2f9d3f2cef8cab64c81dc26516b451dc8cd2b1f9

Download Submit
C:\Windows\{E7C7AC88-68EF-4d9f-8B89-944C9AD13670}.exe

Filesize
180KB

MD5
32b12c92e3dbeb785e493393cf82e7d0

SHA1
8de9b9aa322c12ca8e4c362603fc3f39f007f698

SHA256
5e2289523794a93a46d8c8078b239ef971789203cf378a21378176f7ad808368

SHA512
0e36c26cdac3b4dac29f52bf6b6058376db0cfff0616de2d8dca60d584d7c6c30b8edcc6528acdbdd4f54aad31c35fc128c66010189792332830572a27c7bc9c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads