804d7ac5bceccc1f1103cededcea7059706859dac83508a824c2c8f2f61ba22b

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
Size

168KB
MD5

79ab9aa6f6b8fcfa2b43713f4baf4b0a
SHA1

d8b5a4a2920c021149343b30b7a079cd820ea594
SHA256

804d7ac5bceccc1f1103cededcea7059706859dac83508a824c2c8f2f61ba22b
SHA512

2b5ee2bfb24ecb1464d37499cad2d6aec04609c081c436ea62db99b6c316fb0112f59a8ac03da88b3c8552c949d7a90d45adaa24644c73a4a2cc9a66c85483c0
SSDEEP

1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x001600000000f84c-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001700000000f84c-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001800000000f84c-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001900000000f84c-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001a00000000f84c-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001b00000000f84c-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{107C278D-1227-4460-B1B5-685F4FD127DB}\stubpath = "C:\\Windows\\{107C278D-1227-4460-B1B5-685F4FD127DB}.exe"	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}	{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F416D5A-A792-4f8e-A759-988FDAC3B935}	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{872BA157-1441-4e04-9665-5B54484C1C7A}	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B06333B-D2FF-4e51-88E2-99A057503D86}	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1B06333B-D2FF-4e51-88E2-99A057503D86}\stubpath = "C:\\Windows\\{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe"	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}\stubpath = "C:\\Windows\\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe"	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}\stubpath = "C:\\Windows\\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe"	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}\stubpath = "C:\\Windows\\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe"	{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{872BA157-1441-4e04-9665-5B54484C1C7A}\stubpath = "C:\\Windows\\{872BA157-1441-4e04-9665-5B54484C1C7A}.exe"	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{107C278D-1227-4460-B1B5-685F4FD127DB}	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}	{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}\stubpath = "C:\\Windows\\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe"	{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}\stubpath = "C:\\Windows\\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe"	{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}	{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}\stubpath = "C:\\Windows\\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe"	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7F416D5A-A792-4f8e-A759-988FDAC3B935}\stubpath = "C:\\Windows\\{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe"	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}\stubpath = "C:\\Windows\\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe"	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
1952	{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
1624	{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
2308	{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
2024	{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
File created	C:\Windows\{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
File created	C:\Windows\{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
File created	C:\Windows\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
File created	C:\Windows\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe	{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
File created	C:\Windows\{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
File created	C:\Windows\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
File created	C:\Windows\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
File created	C:\Windows\{107C278D-1227-4460-B1B5-685F4FD127DB}.exe	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
File created	C:\Windows\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe	{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
File created	C:\Windows\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe	{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
Token: SeIncBasePriorityPrivilege	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
Token: SeIncBasePriorityPrivilege	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
Token: SeIncBasePriorityPrivilege	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
Token: SeIncBasePriorityPrivilege	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
Token: SeIncBasePriorityPrivilege	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
Token: SeIncBasePriorityPrivilege	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
Token: SeIncBasePriorityPrivilege	1952	{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
Token: SeIncBasePriorityPrivilege	1624	{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
Token: SeIncBasePriorityPrivilege	2308	{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1180	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	28
PID 3024 wrote to memory of 1180	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	28
PID 3024 wrote to memory of 1180	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	28
PID 3024 wrote to memory of 1180	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	28
PID 3024 wrote to memory of 2724	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	29
PID 3024 wrote to memory of 2724	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	29
PID 3024 wrote to memory of 2724	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	29
PID 3024 wrote to memory of 2724	3024	2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe	29
PID 1180 wrote to memory of 2532	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	32
PID 1180 wrote to memory of 2532	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	32
PID 1180 wrote to memory of 2532	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	32
PID 1180 wrote to memory of 2532	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	32
PID 1180 wrote to memory of 1068	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	33
PID 1180 wrote to memory of 1068	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	33
PID 1180 wrote to memory of 1068	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	33
PID 1180 wrote to memory of 1068	1180	{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe	33
PID 2532 wrote to memory of 2632	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	34
PID 2532 wrote to memory of 2632	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	34
PID 2532 wrote to memory of 2632	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	34
PID 2532 wrote to memory of 2632	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	34
PID 2532 wrote to memory of 2564	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	35
PID 2532 wrote to memory of 2564	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	35
PID 2532 wrote to memory of 2564	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	35
PID 2532 wrote to memory of 2564	2532	{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe	35
PID 2632 wrote to memory of 2400	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	36
PID 2632 wrote to memory of 2400	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	36
PID 2632 wrote to memory of 2400	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	36
PID 2632 wrote to memory of 2400	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	36
PID 2632 wrote to memory of 2880	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	37
PID 2632 wrote to memory of 2880	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	37
PID 2632 wrote to memory of 2880	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	37
PID 2632 wrote to memory of 2880	2632	{872BA157-1441-4e04-9665-5B54484C1C7A}.exe	37
PID 2400 wrote to memory of 2448	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	38
PID 2400 wrote to memory of 2448	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	38
PID 2400 wrote to memory of 2448	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	38
PID 2400 wrote to memory of 2448	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	38
PID 2400 wrote to memory of 2512	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	39
PID 2400 wrote to memory of 2512	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	39
PID 2400 wrote to memory of 2512	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	39
PID 2400 wrote to memory of 2512	2400	{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe	39
PID 2448 wrote to memory of 1432	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	40
PID 2448 wrote to memory of 1432	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	40
PID 2448 wrote to memory of 1432	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	40
PID 2448 wrote to memory of 1432	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	40
PID 2448 wrote to memory of 548	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	41
PID 2448 wrote to memory of 548	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	41
PID 2448 wrote to memory of 548	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	41
PID 2448 wrote to memory of 548	2448	{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe	41
PID 1432 wrote to memory of 1992	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	42
PID 1432 wrote to memory of 1992	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	42
PID 1432 wrote to memory of 1992	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	42
PID 1432 wrote to memory of 1992	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	42
PID 1432 wrote to memory of 1268	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	43
PID 1432 wrote to memory of 1268	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	43
PID 1432 wrote to memory of 1268	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	43
PID 1432 wrote to memory of 1268	1432	{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe	43
PID 1992 wrote to memory of 1952	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	44
PID 1992 wrote to memory of 1952	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	44
PID 1992 wrote to memory of 1952	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	44
PID 1992 wrote to memory of 1952	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	44
PID 1992 wrote to memory of 2036	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	45
PID 1992 wrote to memory of 2036	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	45
PID 1992 wrote to memory of 2036	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	45
PID 1992 wrote to memory of 2036	1992	{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_79ab9aa6f6b8fcfa2b43713f4baf4b0a_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
  C:\Windows\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
    C:\Windows\{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
      C:\Windows\{872BA157-1441-4e04-9665-5B54484C1C7A}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
        
        C:\Windows\{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Windows\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
        
        C:\Windows\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
        
        C:\Windows\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
        
        C:\Windows\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
        
        C:\Windows\{107C278D-1227-4460-B1B5-685F4FD127DB}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
        
        C:\Windows\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
        
        C:\Windows\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
        
        C:\Windows\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe
        
        C:\Windows\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe
        12⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85C3F~1.EXE > nul
        12⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AA377~1.EXE > nul
        11⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{107C2~1.EXE > nul
        10⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{83B7B~1.EXE > nul
        9⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2EB07~1.EXE > nul
        8⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AEAB1~1.EXE > nul
        7⤵
        
        PID:548
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B063~1.EXE > nul
        6⤵
        
        PID:2512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{872BA~1.EXE > nul
        5⤵
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{7F416~1.EXE > nul
      4⤵
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CEB85~1.EXE > nul
    3⤵
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0EEC43A0-1B0B-4d03-9090-53531D9A4636}.exe

Filesize
168KB

MD5
708a092e322830a46505435e9ee24d1f

SHA1
fe32cd608accbd80d11ee05d17e1077e199db605

SHA256
30f94db162a1be81d2bc02bbab0e892c32e4faa321990da49d121ca44fc2d4ca

SHA512
ec3bca20fa1f099f8a83e60b233fd766889b35d1f225993e5873e1569e029affe7f498b9fc6bd2bd782191c2b8c2cd9daaa31b8635a60fc8e96eee555005a0d9

Download Submit
C:\Windows\{107C278D-1227-4460-B1B5-685F4FD127DB}.exe

Filesize
168KB

MD5
22f6eef555c2064e206a0659175f4feb

SHA1
3f710199598443530f14c78311a2627b73ef6a24

SHA256
8752cf93f55f2b7d111bca8977750433be77d33eb0a03675fff9d60e3a503955

SHA512
48fe2be57263a2ec6880d2dc23d3e08380289d7c8f9b668cb00b42da12641157adf23e9ffae57b4dc1c8b92ec5853e1191233d475dee45135e05ef6204ed41af

Download Submit
C:\Windows\{1B06333B-D2FF-4e51-88E2-99A057503D86}.exe

Filesize
168KB

MD5
4b73486c028c317622dbc2e872685c3d

SHA1
5801072efd634e99677f613e9e3cd55b241d421b

SHA256
3edc930c451065ddafc1ac02af87b9468f23fafb5cd7294105c354fb6333c0f0

SHA512
045af597172c3d4f787c2e1cc4f704d751b9bdff6b378d88c9ab4161198bcae9a299a411a8dcb4c73a99e1594d9dd38500d09e454280f34b405bd90f2ae740d9

Download Submit
C:\Windows\{2EB07D3D-D219-44b3-8FB2-8C9A72BC0CBE}.exe

Filesize
168KB

MD5
adb992db4231baf8fadaf9fd88620bc8

SHA1
0f048518a07f45f94d5ebf63f3c3ef001332d042

SHA256
5a28e8a3fea5b7ff2f45a75d2c3514fedcc5373023577a619588de2465aa25ae

SHA512
19c3ed3102a9d94763b191710bfe4d816cf26674cd3d44a32b0b031af5be84c76d3c9e34efb35c0c02f9473322d410681e71464a62181cdaf235d92b7ff9d8a5

Download Submit
C:\Windows\{7F416D5A-A792-4f8e-A759-988FDAC3B935}.exe

Filesize
168KB

MD5
acedda312fad84035e6974de77ce010b

SHA1
801e14ac841af3af2831a7d3b0f916b810468074

SHA256
f04b5c398046b6b71eac3c3637895f2b29a26c15fa976d2d6bfb17cf4716c167

SHA512
5bbf0d70125234d27b129a1c4ccaaaf4b9fa5238351b255ecd84ceede6964bf24f366b77930f03a4893b94065c70d0eaade4e83ab7c9c0bda82d40eefc507096

Download Submit
C:\Windows\{83B7BA18-BEA4-482b-BAE4-94496EF4FC08}.exe

Filesize
168KB

MD5
6df67f4a4922282731d53a6c9258f120

SHA1
8db6aec708e2b3de6da6cfa31d624a1947a37726

SHA256
1698612fabe912e278364a68a9f8d439f3899a61690f63fe268cda2301ca3187

SHA512
d4266170ade7432c71db279ddad8a7e1cae46abe3799899cdebb2f2aab54bd701aa6ad1bb29727b5b0a5ae4e16bd40a78402f2a6513d2040df6c196d09743807

Download Submit
C:\Windows\{85C3FF0A-6AA2-4ea6-955A-63E59F399D70}.exe

Filesize
168KB

MD5
6a3852749ed4f9ba188957d159598822

SHA1
8e30a244d57ed1ed6688bbee85738e08e4187609

SHA256
fce94dfae2b9cc8ea97af6141c87b2fe06345e187b8fdc00058176757b56ee21

SHA512
ba9ffa826d401145c015d2698ae7d292c31532e2e6240bce9503793a51b3e6619d82d3ab92deaee44772326ff8383e1d73a0feb5a9264a2682a532592a15d54f

Download Submit
C:\Windows\{872BA157-1441-4e04-9665-5B54484C1C7A}.exe

Filesize
168KB

MD5
682894062adfd79b5b8a7fe6082c7f16

SHA1
b2fd7608c1af03ef804fa0e216121a16a5377c15

SHA256
d4c9b88cb6340aaa89f28948280bb857eb284626817d554875ce2771fa65eecf

SHA512
b05f45de9dc6ca04962ad46d31fb85e831fa55fb9d71a4a5ffdb7f0444ed4f2320f19724fa72b483e98a9b4b18e7588dda5a7cce016ae71c4830926ceeb9e234

Download Submit
C:\Windows\{AA377F8C-7F51-4819-93C2-B9A5C6DE4F06}.exe

Filesize
168KB

MD5
d7e4c5bb85a17a95b030b2ed9bbad120

SHA1
83f13fd3eab057d80f49a36970e81aa4ad3cf3ba

SHA256
20a11dac37d8a5c80359ab89c32926a3d657a80d71d254750814d7222a206ba3

SHA512
94750310b2c0c0a99bcc687f85ac8ec2952617548dee1516d550944b3fe50e463fc1215f1d4e8345bd1f13e3f13671025fa5bb8680bb25faef0fd24c09b66f41

Download Submit
C:\Windows\{AEAB12DA-6391-4b75-A9EA-389449DF06F5}.exe

Filesize
168KB

MD5
b6feffff7c1176db0233cfc46565bca9

SHA1
6fd08c5134de21b3575f347036545ad8db37bf7e

SHA256
72c0e1a1f2f9318fc2fb9d7d3c94e9ca3238f7651189b79c6a880fbb0f321e8a

SHA512
860721bd745ab30ac7edfe4a9755079dd875534d84503a53a1e33c827d8635ee8ffdf172c3364a5b315c6b9296beae624e1accaca4f706385cb76d8ec01f0ace

Download Submit
C:\Windows\{CEB85886-BFCB-47e0-A21A-BFCB44F386D1}.exe

Filesize
168KB

MD5
252e51dda43ebbbe36c560d67dfcf3f5

SHA1
00e2182a13a96868b3e71c21d2997e0d1f6dd2c0

SHA256
3b9781707284da074fdf8ba9ba9ff3e979aaa78161435982f9e872fc5c554ff6

SHA512
a83a6aab8179af9ce1610325d814bef99a79e8835bfa5e68e3e1641b73884e5f48cef7113ef73a3d991fac5f5e861a472d0706933a0d2ec852d1bdbe9a94148f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads