3839648394ce16200e15008f78114a5a52d2a8b2724387fdc6bfac63a7607779

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
Size

197KB
MD5

b967aa2f7b6f78bc3ff9d9d2065003fb
SHA1

bb3d606784053d409ec481b7cb90201f41ef2b91
SHA256

3839648394ce16200e15008f78114a5a52d2a8b2724387fdc6bfac63a7607779
SHA512

396e8a8b81a9ea96d068485957237be51500e2bb8cf027f3395939a1009a059df5e13de4463e3a1c0ec305921e70e04f6dd440ee2ce1737a4cb24938b8ad2cc2
SSDEEP

3072:jEGh0obZl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGnlEeKcAEca

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015df1-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015f7a-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015df1-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000016a29-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000005a59-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015df1-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000005a59-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015df1-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000005a59-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015df1-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000005a59-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}\stubpath = "C:\\Windows\\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe"	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FBFB048-450D-4011-B474-1556CD0E0D20}\stubpath = "C:\\Windows\\{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe"	{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2B209960-BF16-44eb-879A-A0196CCBF157}	{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}\stubpath = "C:\\Windows\\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe"	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A55B2E93-D449-4d6a-9227-632B9DF39412}	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E11828D5-6843-45cf-908E-588C11A23AC9}\stubpath = "C:\\Windows\\{E11828D5-6843-45cf-908E-588C11A23AC9}.exe"	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7A84110-4932-4657-BD21-DB2EB8532346}\stubpath = "C:\\Windows\\{E7A84110-4932-4657-BD21-DB2EB8532346}.exe"	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}\stubpath = "C:\\Windows\\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe"	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E7A84110-4932-4657-BD21-DB2EB8532346}	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7FBFB048-450D-4011-B474-1556CD0E0D20}	{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}\stubpath = "C:\\Windows\\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe"	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF005F9D-9740-4749-B1EA-820F7BA8931B}	{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AF005F9D-9740-4749-B1EA-820F7BA8931B}\stubpath = "C:\\Windows\\{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe"	{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A55B2E93-D449-4d6a-9227-632B9DF39412}\stubpath = "C:\\Windows\\{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe"	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E11828D5-6843-45cf-908E-588C11A23AC9}	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}\stubpath = "C:\\Windows\\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe"	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2B209960-BF16-44eb-879A-A0196CCBF157}\stubpath = "C:\\Windows\\{2B209960-BF16-44eb-879A-A0196CCBF157}.exe"	{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe

Deletes itself 1 IoCs

pid	Process
2028	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
1792	{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
2708	{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
692	{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe
2952	{2B209960-BF16-44eb-879A-A0196CCBF157}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
File created	C:\Windows\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
File created	C:\Windows\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
File created	C:\Windows\{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
File created	C:\Windows\{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe	{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
File created	C:\Windows\{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe	{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
File created	C:\Windows\{2B209960-BF16-44eb-879A-A0196CCBF157}.exe	{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe
File created	C:\Windows\{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
File created	C:\Windows\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
File created	C:\Windows\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
File created	C:\Windows\{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
Token: SeIncBasePriorityPrivilege	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
Token: SeIncBasePriorityPrivilege	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
Token: SeIncBasePriorityPrivilege	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
Token: SeIncBasePriorityPrivilege	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
Token: SeIncBasePriorityPrivilege	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
Token: SeIncBasePriorityPrivilege	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
Token: SeIncBasePriorityPrivilege	1792	{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
Token: SeIncBasePriorityPrivilege	2708	{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
Token: SeIncBasePriorityPrivilege	692	{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2996	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	28
PID 2924 wrote to memory of 2996	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	28
PID 2924 wrote to memory of 2996	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	28
PID 2924 wrote to memory of 2996	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	28
PID 2924 wrote to memory of 2028	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	29
PID 2924 wrote to memory of 2028	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	29
PID 2924 wrote to memory of 2028	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	29
PID 2924 wrote to memory of 2028	2924	2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe	29
PID 2996 wrote to memory of 2700	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	30
PID 2996 wrote to memory of 2700	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	30
PID 2996 wrote to memory of 2700	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	30
PID 2996 wrote to memory of 2700	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	30
PID 2996 wrote to memory of 2624	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	31
PID 2996 wrote to memory of 2624	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	31
PID 2996 wrote to memory of 2624	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	31
PID 2996 wrote to memory of 2624	2996	{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe	31
PID 2700 wrote to memory of 2776	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	32
PID 2700 wrote to memory of 2776	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	32
PID 2700 wrote to memory of 2776	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	32
PID 2700 wrote to memory of 2776	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	32
PID 2700 wrote to memory of 2840	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	33
PID 2700 wrote to memory of 2840	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	33
PID 2700 wrote to memory of 2840	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	33
PID 2700 wrote to memory of 2840	2700	{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe	33
PID 2776 wrote to memory of 2172	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	36
PID 2776 wrote to memory of 2172	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	36
PID 2776 wrote to memory of 2172	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	36
PID 2776 wrote to memory of 2172	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	36
PID 2776 wrote to memory of 2136	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	37
PID 2776 wrote to memory of 2136	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	37
PID 2776 wrote to memory of 2136	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	37
PID 2776 wrote to memory of 2136	2776	{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe	37
PID 2172 wrote to memory of 2900	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	38
PID 2172 wrote to memory of 2900	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	38
PID 2172 wrote to memory of 2900	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	38
PID 2172 wrote to memory of 2900	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	38
PID 2172 wrote to memory of 1540	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	39
PID 2172 wrote to memory of 1540	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	39
PID 2172 wrote to memory of 1540	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	39
PID 2172 wrote to memory of 1540	2172	{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe	39
PID 2900 wrote to memory of 2720	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	40
PID 2900 wrote to memory of 2720	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	40
PID 2900 wrote to memory of 2720	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	40
PID 2900 wrote to memory of 2720	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	40
PID 2900 wrote to memory of 2748	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	41
PID 2900 wrote to memory of 2748	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	41
PID 2900 wrote to memory of 2748	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	41
PID 2900 wrote to memory of 2748	2900	{E11828D5-6843-45cf-908E-588C11A23AC9}.exe	41
PID 2720 wrote to memory of 2904	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	42
PID 2720 wrote to memory of 2904	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	42
PID 2720 wrote to memory of 2904	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	42
PID 2720 wrote to memory of 2904	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	42
PID 2720 wrote to memory of 2276	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	43
PID 2720 wrote to memory of 2276	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	43
PID 2720 wrote to memory of 2276	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	43
PID 2720 wrote to memory of 2276	2720	{E7A84110-4932-4657-BD21-DB2EB8532346}.exe	43
PID 2904 wrote to memory of 1792	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	44
PID 2904 wrote to memory of 1792	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	44
PID 2904 wrote to memory of 1792	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	44
PID 2904 wrote to memory of 1792	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	44
PID 2904 wrote to memory of 2200	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	45
PID 2904 wrote to memory of 2200	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	45
PID 2904 wrote to memory of 2200	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	45
PID 2904 wrote to memory of 2200	2904	{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_b967aa2f7b6f78bc3ff9d9d2065003fb_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
  C:\Windows\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
    C:\Windows\{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
      C:\Windows\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
        
        C:\Windows\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Windows\{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
        
        C:\Windows\{E11828D5-6843-45cf-908E-588C11A23AC9}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
        
        C:\Windows\{E7A84110-4932-4657-BD21-DB2EB8532346}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
        
        C:\Windows\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
        
        C:\Windows\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
        
        C:\Windows\{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
        
        C:\Windows\{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe
        
        C:\Windows\{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
        
        C:\Windows\{2B209960-BF16-44eb-879A-A0196CCBF157}.exe
        
        C:\Windows\{2B209960-BF16-44eb-879A-A0196CCBF157}.exe
        12⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7FBFB~1.EXE > nul
        12⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AF005~1.EXE > nul
        11⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2C42~1.EXE > nul
        10⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9EB4E~1.EXE > nul
        9⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E7A84~1.EXE > nul
        8⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E1182~1.EXE > nul
        7⤵
        
        PID:2748
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7065E~1.EXE > nul
        6⤵
        
        PID:1540
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{53D0A~1.EXE > nul
        5⤵
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A55B2~1.EXE > nul
      4⤵
      PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{95266~1.EXE > nul
    3⤵
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{2B209960-BF16-44eb-879A-A0196CCBF157}.exe

Filesize
197KB

MD5
9750856dfecb04556e3d6f604a97557c

SHA1
353725f779b46e21ec7eba4098676708c0b4111f

SHA256
79f6b8c1e0972974d1afd7fb42ea5d2d48707f77cac2f3cbfdced9cbf554a7a7

SHA512
6b3854b34bc6ca5645b348732258e42f33b355a2d7d8fb231112d89ebfdb2703a63032787cbc7f649f0efbea7bc8aeda69a8c25be3f508717c81e4e3116b5d5f

Download Submit
C:\Windows\{53D0A30D-9207-4cab-AFCF-AA4E72CA1BF2}.exe

Filesize
197KB

MD5
1d8657a4f4c0d32dc83599925c5f71a6

SHA1
a1d8d2cbd606798918e78c04fd2c2fef499cdc8d

SHA256
7f54e4b6b68c56807907a271fe4f73df706e52b6317441ca5df91ecda444f92d

SHA512
f68db8bf6ff97d7c9e17abb60102a339b2e6ca955a58359ddea28b7873092a83dcf4ff879ae4c82b6535bac8d7085ea3bb4fe667c146ab38867684f5310c0198

Download Submit
C:\Windows\{7065E151-D58E-4b6e-AB9E-2BA3C79B919B}.exe

Filesize
197KB

MD5
6f08bee6c18e3afdab1785ea1210cc30

SHA1
aaf04d967be2f16d276eb1012b79c2112ca70cb9

SHA256
37c32a88d2254d1e4c522fd991c685233414ce5c4e60965c65fe81a3d67d0117

SHA512
30cb2cb46f41aa9b9283fe68aafadd07ad7f35aee5cbf55e5c659da50dc128955cfa9d99a4e1644b026ee47cc9da8d22745a5050d0b71098a53357889b21fad1

Download Submit
C:\Windows\{7FBFB048-450D-4011-B474-1556CD0E0D20}.exe

Filesize
197KB

MD5
4979a18ce1275b17988ee5f7894d8cb1

SHA1
c78662f65375c5e81f541c43992462b64c9a9cbb

SHA256
226181a24cc8f7a07a617c05a3f12a3693abe083bbed71c0a8df73d5a602fb13

SHA512
4c61a8eca1b99a12449d5374a8acb9a16ad99f305c9f6b6e495d60977416264188f30a2a04552554630d92166ce93a6798bd3ea53f5ae0ebf8671bf855678181

Download Submit
C:\Windows\{95266FC1-48F1-43ea-9CF7-C38A7EC91C1B}.exe

Filesize
197KB

MD5
fb33e489983ca50a6006365d0bce2f1c

SHA1
24b28809280995be4e4eb321b0b72564c065d821

SHA256
828d03b8ffdc4a6ea6608ca7e791fc19ca5501edcb3d3f9e6139971fb4d4c0a3

SHA512
067ba7669ae255a1ad36e286a3a035f7fa35d0cc1ea5c8c72da19a57e34f5b91b54f0d0d3e36220f41e6c10ffc40c32070890c40fc97a73b952c260e80c8428b

Download Submit
C:\Windows\{9EB4EBC8-2F3E-4336-9773-7227171CC4D8}.exe

Filesize
197KB

MD5
cb383f0cab334fa616be2f6fdb0b8096

SHA1
21074e500cc199cb6e232defc05666dcff7a17eb

SHA256
bd881139f685e23606e08c95d2d3674989ca94d709289a3fc989a29f783a8ed4

SHA512
e6a18f1218069c3f02f4c30a2080eb0acc0497441b2483b7b3712aaa6d46d55964d78feb190e56d3480789976e4d3ce756ab79a9e3cce025d82454806cced0c5

Download Submit
C:\Windows\{A55B2E93-D449-4d6a-9227-632B9DF39412}.exe

Filesize
197KB

MD5
d6c107d66790223d2fd1aaf7320e0316

SHA1
b4847b7faa1aee5e33a543de3c790df2f1db434f

SHA256
8f12dc68a5458199c22100e7917098fdf8628f96023c477858dc94807967c499

SHA512
b09038ba4a358cc4cd6d6ae3800b532bced8386aea74a0cd0d91eee6262ae9faf7441c4552305391c4c220ff3777edf792aa161ccfbc98e9a371f66d07dbb6f6

Download Submit
C:\Windows\{AF005F9D-9740-4749-B1EA-820F7BA8931B}.exe

Filesize
197KB

MD5
722d6bbf8d40c479a0ef5b9c965a1532

SHA1
0857ab7d15fc92f73e201432875fcb1659cf32ce

SHA256
b63c9532fe897f8af8f14bbf114fbf0435800fdd9cd926cf258df3ea86a28d5c

SHA512
4cb22160283e3c598cc84a83abeafd6d190cfc1c4ad00f9700291851b62dffc6ca0ecef8e8000c876510b508a531f358de92059b0a6fa8b043c2bab483abfd79

Download Submit
C:\Windows\{E11828D5-6843-45cf-908E-588C11A23AC9}.exe

Filesize
197KB

MD5
f5dddbf938d4593b06dd770ee3aeeca2

SHA1
c87551f773bf0a06cf373bad20126b97c7df6246

SHA256
c6088845782c6f599e7fda0fe3d241cea4c070dc38c146ab6208a5ce1de34460

SHA512
cb5ba82b59e5553f636aa0013347f2f21cdc2977d1cd39d68fac1a531676ae424ada623a0b90fa6dca446b5abcc3dab6b53f526586b04f9981a764346f79f207

Download Submit
C:\Windows\{E2C428C0-C26B-4adc-8CB3-E590F17553CC}.exe

Filesize
197KB

MD5
91cd7365d5a33a742d000672ee0eb1a3

SHA1
0903c4e0b68e0878549bf0b5a35c639e2fb65ed0

SHA256
b0e3d5c0341b4cc8039d8cc042aab345256f8068282dbb37af2e4ba1821f6f1d

SHA512
92cc4d5b5250e80986ab37f13d046730d7ce23d83500cbe257815c7e915c6761e3dcc15d698f2be5fab02fd9154493bfcd1737ae15ba3ea4ae8b17fa1f475543

Download Submit
C:\Windows\{E7A84110-4932-4657-BD21-DB2EB8532346}.exe

Filesize
197KB

MD5
82601e4d49411b0c551be50ea0433394

SHA1
2c9515773bda39d173facc64a585d7df21bec540

SHA256
f954793c0b9247a5dcae0791fb31a4754f2055918e257148f138079dacb244e4

SHA512
14b045da3a75c026bc56bae0642b61a19af1c7aeaa7bd749ff4477f2aac4ac719fa4a181748cf605f8c0d2c729d81bf5c51e4679554dffb0db139ff92cf91713

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads