82c3f2a39b1cb9b73c015bc9e62b9922ea42fde7d663ad98f4a3ec72554581f9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
Size

204KB
MD5

4b5eb739454a2c236bef477ea28d5bbf
SHA1

f8869baa983a74cef0a52f2b4045690176f35a8d
SHA256

82c3f2a39b1cb9b73c015bc9e62b9922ea42fde7d663ad98f4a3ec72554581f9
SHA512

05227427c5671d08d8defa631d7d40cba01e71690ad81c8c5f6395cb1ab490bbd9da3e03c074adbe743f775ac807d0780a9b0133bf3547426db960d14bd8db54
SSDEEP

1536:1EGh0oWCl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oWCl1OPOe2MUVg3Ve+rXfMUy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023219-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023212-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023220-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0008000000023221-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000006d5-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0002000000021c86-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000006d5-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000300000000070d-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000006d5-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000400000000070d-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000006d5-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000000733-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{613C4033-F235-4af9-92CB-9D790D32E79D}\stubpath = "C:\\Windows\\{613C4033-F235-4af9-92CB-9D790D32E79D}.exe"	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}\stubpath = "C:\\Windows\\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe"	{5565996D-9C93-4961-AED6-093A638CFC61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBAD367-0902-4ea6-9153-AB80B0287670}	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}	{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02125B33-99A8-47e0-BA8E-FA62358B4759}	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}\stubpath = "C:\\Windows\\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe"	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F738A2F0-D27F-41cd-8181-75FB463E3A74}	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{613C4033-F235-4af9-92CB-9D790D32E79D}	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5565996D-9C93-4961-AED6-093A638CFC61}	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{253FC0E0-1392-4151-8376-09475402E3F4}	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{253FC0E0-1392-4151-8376-09475402E3F4}\stubpath = "C:\\Windows\\{253FC0E0-1392-4151-8376-09475402E3F4}.exe"	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E06F678-75F5-45bc-B840-C6731E05144F}	{253FC0E0-1392-4151-8376-09475402E3F4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E06F678-75F5-45bc-B840-C6731E05144F}\stubpath = "C:\\Windows\\{4E06F678-75F5-45bc-B840-C6731E05144F}.exe"	{253FC0E0-1392-4151-8376-09475402E3F4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}\stubpath = "C:\\Windows\\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe"	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}\stubpath = "C:\\Windows\\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe"	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBAD367-0902-4ea6-9153-AB80B0287670}\stubpath = "C:\\Windows\\{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe"	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02125B33-99A8-47e0-BA8E-FA62358B4759}\stubpath = "C:\\Windows\\{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe"	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F738A2F0-D27F-41cd-8181-75FB463E3A74}\stubpath = "C:\\Windows\\{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe"	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5565996D-9C93-4961-AED6-093A638CFC61}\stubpath = "C:\\Windows\\{5565996D-9C93-4961-AED6-093A638CFC61}.exe"	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}	{5565996D-9C93-4961-AED6-093A638CFC61}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}\stubpath = "C:\\Windows\\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe"	{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe

Executes dropped EXE 12 IoCs

pid	Process
3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe
2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe
4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
1236	{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe
4596	{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{253FC0E0-1392-4151-8376-09475402E3F4}.exe	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
File created	C:\Windows\{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	{253FC0E0-1392-4151-8376-09475402E3F4}.exe
File created	C:\Windows\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe	{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe
File created	C:\Windows\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	{5565996D-9C93-4961-AED6-093A638CFC61}.exe
File created	C:\Windows\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
File created	C:\Windows\{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
File created	C:\Windows\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
File created	C:\Windows\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
File created	C:\Windows\{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
File created	C:\Windows\{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
File created	C:\Windows\{5565996D-9C93-4961-AED6-093A638CFC61}.exe	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
File created	C:\Windows\{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe
Token: SeIncBasePriorityPrivilege	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
Token: SeIncBasePriorityPrivilege	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
Token: SeIncBasePriorityPrivilege	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
Token: SeIncBasePriorityPrivilege	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
Token: SeIncBasePriorityPrivilege	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
Token: SeIncBasePriorityPrivilege	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
Token: SeIncBasePriorityPrivilege	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe
Token: SeIncBasePriorityPrivilege	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
Token: SeIncBasePriorityPrivilege	4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
Token: SeIncBasePriorityPrivilege	1236	{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3236	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	96
PID 1716 wrote to memory of 3236	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	96
PID 1716 wrote to memory of 3236	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	96
PID 1716 wrote to memory of 3420	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	97
PID 1716 wrote to memory of 3420	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	97
PID 1716 wrote to memory of 3420	1716	2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe	97
PID 3236 wrote to memory of 2000	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	98
PID 3236 wrote to memory of 2000	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	98
PID 3236 wrote to memory of 2000	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	98
PID 3236 wrote to memory of 620	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	99
PID 3236 wrote to memory of 620	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	99
PID 3236 wrote to memory of 620	3236	{253FC0E0-1392-4151-8376-09475402E3F4}.exe	99
PID 2000 wrote to memory of 1768	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	101
PID 2000 wrote to memory of 1768	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	101
PID 2000 wrote to memory of 1768	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	101
PID 2000 wrote to memory of 4788	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	102
PID 2000 wrote to memory of 4788	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	102
PID 2000 wrote to memory of 4788	2000	{4E06F678-75F5-45bc-B840-C6731E05144F}.exe	102
PID 1768 wrote to memory of 3112	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	103
PID 1768 wrote to memory of 3112	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	103
PID 1768 wrote to memory of 3112	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	103
PID 1768 wrote to memory of 2576	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	104
PID 1768 wrote to memory of 2576	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	104
PID 1768 wrote to memory of 2576	1768	{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe	104
PID 3112 wrote to memory of 4492	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	105
PID 3112 wrote to memory of 4492	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	105
PID 3112 wrote to memory of 4492	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	105
PID 3112 wrote to memory of 5108	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	106
PID 3112 wrote to memory of 5108	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	106
PID 3112 wrote to memory of 5108	3112	{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe	106
PID 4492 wrote to memory of 4184	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	107
PID 4492 wrote to memory of 4184	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	107
PID 4492 wrote to memory of 4184	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	107
PID 4492 wrote to memory of 2992	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	108
PID 4492 wrote to memory of 2992	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	108
PID 4492 wrote to memory of 2992	4492	{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe	108
PID 4184 wrote to memory of 368	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	109
PID 4184 wrote to memory of 368	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	109
PID 4184 wrote to memory of 368	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	109
PID 4184 wrote to memory of 2564	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	110
PID 4184 wrote to memory of 2564	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	110
PID 4184 wrote to memory of 2564	4184	{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe	110
PID 368 wrote to memory of 436	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	111
PID 368 wrote to memory of 436	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	111
PID 368 wrote to memory of 436	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	111
PID 368 wrote to memory of 4684	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	112
PID 368 wrote to memory of 4684	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	112
PID 368 wrote to memory of 4684	368	{613C4033-F235-4af9-92CB-9D790D32E79D}.exe	112
PID 436 wrote to memory of 4736	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	113
PID 436 wrote to memory of 4736	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	113
PID 436 wrote to memory of 4736	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	113
PID 436 wrote to memory of 4932	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	114
PID 436 wrote to memory of 4932	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	114
PID 436 wrote to memory of 4932	436	{5565996D-9C93-4961-AED6-093A638CFC61}.exe	114
PID 4736 wrote to memory of 4948	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	115
PID 4736 wrote to memory of 4948	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	115
PID 4736 wrote to memory of 4948	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	115
PID 4736 wrote to memory of 3536	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	116
PID 4736 wrote to memory of 3536	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	116
PID 4736 wrote to memory of 3536	4736	{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe	116
PID 4948 wrote to memory of 1236	4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe	117
PID 4948 wrote to memory of 1236	4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe	117
PID 4948 wrote to memory of 1236	4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe	117
PID 4948 wrote to memory of 4556	4948	{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_4b5eb739454a2c236bef477ea28d5bbf_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\{253FC0E0-1392-4151-8376-09475402E3F4}.exe
  C:\Windows\{253FC0E0-1392-4151-8376-09475402E3F4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
    C:\Windows\{4E06F678-75F5-45bc-B840-C6731E05144F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
      C:\Windows\{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
        
        C:\Windows\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3112
      - C:\Windows\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
        
        C:\Windows\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
        
        C:\Windows\{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
        
        C:\Windows\{613C4033-F235-4af9-92CB-9D790D32E79D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\{5565996D-9C93-4961-AED6-093A638CFC61}.exe
        
        C:\Windows\{5565996D-9C93-4961-AED6-093A638CFC61}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
        
        C:\Windows\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
        
        C:\Windows\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe
        
        C:\Windows\{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe
        
        C:\Windows\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe
        13⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0BBAD~1.EXE > nul
        13⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1AD00~1.EXE > nul
        12⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58FAC~1.EXE > nul
        11⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{55659~1.EXE > nul
        10⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{613C4~1.EXE > nul
        9⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F738A~1.EXE > nul
        8⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4BB46~1.EXE > nul
        7⤵
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9FC3~1.EXE > nul
        6⤵
        
        PID:5108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{02125~1.EXE > nul
        5⤵
        
        PID:2576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{4E06F~1.EXE > nul
      4⤵
      PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{253FC~1.EXE > nul
    3⤵
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{02125B33-99A8-47e0-BA8E-FA62358B4759}.exe

Filesize
204KB

MD5
a9d75dd8a1732c40e3a6f60eeac1760e

SHA1
cabf54fbad478b6c501cc8ac978d91beee4ec000

SHA256
2515993cd90a77f7eb35395061c63dc44d51acf5d205df1cb12eef068699944c

SHA512
5dad93cd75b159e2ff82e0aa3fcfb873c1c5ba2fec3930d7169f55469043b8dbd209f930b4234d621b80bd42bd4b1098eed74e54eb63dde502f02679f797b446

Download Submit
C:\Windows\{0BBAD367-0902-4ea6-9153-AB80B0287670}.exe

Filesize
204KB

MD5
473cf791cd3be5d2b3755854f99441c4

SHA1
9a4ecbbd4b494047928b173db9eaa4f0383e0fe5

SHA256
960e2c494df91c6b0cd09230322380e9b2f505cdde8da09a9a9de854b3867f94

SHA512
5418140046484e3d5c4b905619c16d49d3bd8d513a01ed3cd0208dfe293d261377446af9873540a96ed9db05c68940b8214e3ba852a8f5e943a1ef9e1cd596c9

Download Submit
C:\Windows\{1AD00C1F-3012-4830-B931-EFB6B23FD5B9}.exe

Filesize
204KB

MD5
a167a51a35269b1cdabe222008154de7

SHA1
c21db78a2d1c3449d27e21c421d631abca67cc71

SHA256
0f29bf05fdaa7b9fbbe02dd2749acad707a03a2b2418dcb09197387694de6d0d

SHA512
987afb7557157996e46dda550bdc22a8d2e8da1688a4093d5fa83a7faf0189b5dae73b50fcae03b8c8c55da520ec2407c9bc625f89e601fe44d492847ea246db

Download Submit
C:\Windows\{253FC0E0-1392-4151-8376-09475402E3F4}.exe

Filesize
204KB

MD5
92297b8ee4ecd77d591d0798d71ac35c

SHA1
c47948d5ae759c8efab6e7996a74cd4fb442b300

SHA256
976099bd05d378d5e8a353685a1d3800381a9ed3493530203c17b9f5dcede34a

SHA512
9b35ef9555a333bb1f66f77f048db60dce9cb964aaebf2b6f12f4c70256a3dde0473dd77f5a6fd4b6d0b5c9c761cea3f977cf9f4603fe40ef45f6b55a313da9b

Download Submit
C:\Windows\{4BB46FE5-C010-4de6-A129-D7FB3636F1D5}.exe

Filesize
204KB

MD5
0967c7cef40959e62be6d83f97a33edd

SHA1
c536dc29e0f930e817bedfa36ade72a3fb552424

SHA256
3090e3b44ddee8957cee47ca97e0238d5830deb93116064342cd25f96741d021

SHA512
beb8cd924c330358b137d89cd6924d2878d3c6768c9ee65b5c02bd874ff75903a3bf6ef1ca614d782c2aa77ef60f886361c8ebaa9d495a6f3db5ba9b56425d52

Download Submit
C:\Windows\{4E06F678-75F5-45bc-B840-C6731E05144F}.exe

Filesize
204KB

MD5
254dd6b1678339470e94b84b1ccf75ae

SHA1
40edf3293d625fa4ab74997207d85828754285a9

SHA256
3c824bf5f1ddb467945d379353dedf571c30a5abd52f985a62367e76261d5206

SHA512
681c724e7044edf7f01ef830f39002992d518789fea37e63744eaf77708751ea5268f6fb5cb7a7524ffa5b4795981d8e8a195a7bc62587b1bd6fa53601895f62

Download Submit
C:\Windows\{5565996D-9C93-4961-AED6-093A638CFC61}.exe

Filesize
204KB

MD5
2d05654398bda9b633a20f07c35b4c9f

SHA1
85b11b523c59fdb9f7b9c7a15cfb04b3bb840d87

SHA256
9f91b1c9d5d123539d94e666e2e33b8625a0d9e6041cf43669d64c77b9850ee1

SHA512
b8a3a5e16d0c1be856cb38c4468f26c679191d829cd84d0bc2a9376de2a9c8918bab77b32197d22c0df3930b2febb177204f71f364feb42efb33860df649f46c

Download Submit
C:\Windows\{58FAC859-1AEC-4f2c-B69E-ABAFF38A026E}.exe

Filesize
204KB

MD5
e1fd1ed2e263814f07796295667e8f9d

SHA1
4d61656566676674207103f2b124b279b46fbe66

SHA256
40ecd5d7a83d5fabc59e231522f98855ce91f4892235d93d9f555ab5b83b8220

SHA512
6efedfee480276d5daa714fd74fc030963ff6dcc675cc95ef29a55ddd3fade4aea4c698cdbeab781aea7eb8e3ccc59af2bd1c0db541bf52fe6dc1ab0d05725f5

Download Submit
C:\Windows\{613C4033-F235-4af9-92CB-9D790D32E79D}.exe

Filesize
204KB

MD5
105ef58c7cacd99f46580c14ffe03327

SHA1
ade12b741c91fc4785b17278731628b14e071854

SHA256
7cecca2c34c44547ed7c22c0dc9656e4f65ebe50103c119b97236d4c33fac685

SHA512
fab1d1f6baf3082e32678f3e3a0b958d9a706e87fef17a4c5cc358c5fdba29d39d94938ac9607dccb56f523d597ae73819b016a1749ebe18019084d1555f3b74

Download Submit
C:\Windows\{962651F3-1FFC-4a8a-ADDD-40CA6A724E4D}.exe

Filesize
204KB

MD5
b3bee91313cf3718f777b743b9381b10

SHA1
8463a11f41fb47e0dca6ab3d9f63b10802ad12dd

SHA256
f7810f9a6eb3bf9bfae722e53eb6463ab97522602178cda5fc6c3c4d2f1df3e4

SHA512
8e9828374b5015610c904417331e43cfb780659301b3cc7881c3a7b1495f6d63bc7359eff9c643e5b243308ee317d02f2edbc349b52a9f6071ce0b6042d5e52d

Download Submit
C:\Windows\{B9FC3950-3497-4516-B63C-EAFA2DC53EB0}.exe

Filesize
204KB

MD5
8c166db21c8a2857602303b44363dfaf

SHA1
3a8d26ab84a4d9ca6f27221e7198863eb7fd452f

SHA256
4fe50791c1f6c1439cddc85feaf992fbd86a22ec7df566dc37647b23f5f92172

SHA512
4bbdcfef6edaa33555b01cae65f49067936f1796ea86b267a46fcfd0d86af8e40c0398620f37480605d2baad8c30d5dcd73cf9383b96d22d4a975a55879092d3

Download Submit
C:\Windows\{F738A2F0-D27F-41cd-8181-75FB463E3A74}.exe

Filesize
204KB

MD5
5c7acc3afb7734e6f8f37e325f926c4a

SHA1
05c82438c44993ce31d32cca5c2c0306a6b79911

SHA256
1f0e704c8c0b13fb5b0243efc03d76ace07f6c11f639e13a125d9b0203f1c3bf

SHA512
e1fb5edb31fd22979c22a74a283d5ec7f550643805d1afb07f67fed60f7c6273d30490dab997099a0ece1fb4b697a23a8e4655dea06614ffe45b0e1edf1c3dcd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads