ca18d74eada25fe5fa4615a1b669113c808b3a1b7571329e246775c23a8de4b5

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
Size

180KB
MD5

92bbb4d66f3a73d4c4aa0f8fde9febbd
SHA1

118be8f193cba0b4bd079522e7f4c147fdf92d01
SHA256

ca18d74eada25fe5fa4615a1b669113c808b3a1b7571329e246775c23a8de4b5
SHA512

c9cb70886403e3efba0504c6005c1a7198559b7f79167311440c8911ed1139c3a9250cde6a1c079540c0743a27126990163d078f85ed1ae89e86fea791c20fda
SSDEEP

3072:jEGh0oslfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG2l5eKcAEc

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122bf-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000015c85-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00090000000122bf-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000015cd9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a0000000122bf-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b0000000122bf-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c0000000122bf-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}\stubpath = "C:\\Windows\\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe"	{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}	{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0038937B-D619-476f-8264-B6CEB0CCC001}\stubpath = "C:\\Windows\\{0038937B-D619-476f-8264-B6CEB0CCC001}.exe"	{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}\stubpath = "C:\\Windows\\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe"	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB64D9D7-324D-411a-8E22-292493CA9363}	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2722971-694C-4a30-B15A-6869B09D28E1}\stubpath = "C:\\Windows\\{B2722971-694C-4a30-B15A-6869B09D28E1}.exe"	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{151E943A-34F0-47e6-AA02-5CF472061F22}	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{151E943A-34F0-47e6-AA02-5CF472061F22}\stubpath = "C:\\Windows\\{151E943A-34F0-47e6-AA02-5CF472061F22}.exe"	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3438502F-6CAB-44c0-B079-E8AB61874E72}	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14A5F831-64B3-40bb-8F75-87B4E1E22397}	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2722971-694C-4a30-B15A-6869B09D28E1}	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CB64D9D7-324D-411a-8E22-292493CA9363}\stubpath = "C:\\Windows\\{CB64D9D7-324D-411a-8E22-292493CA9363}.exe"	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}	{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}\stubpath = "C:\\Windows\\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe"	{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}\stubpath = "C:\\Windows\\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe"	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14A5F831-64B3-40bb-8F75-87B4E1E22397}\stubpath = "C:\\Windows\\{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe"	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70F34966-7DDF-4482-B7A5-81871F19109C}	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{70F34966-7DDF-4482-B7A5-81871F19109C}\stubpath = "C:\\Windows\\{70F34966-7DDF-4482-B7A5-81871F19109C}.exe"	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0038937B-D619-476f-8264-B6CEB0CCC001}	{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3438502F-6CAB-44c0-B079-E8AB61874E72}\stubpath = "C:\\Windows\\{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe"	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
1260	{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
2772	{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
596	{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
2116	{0038937B-D619-476f-8264-B6CEB0CCC001}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
File created	C:\Windows\{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
File created	C:\Windows\{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
File created	C:\Windows\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe	{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
File created	C:\Windows\{0038937B-D619-476f-8264-B6CEB0CCC001}.exe	{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
File created	C:\Windows\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
File created	C:\Windows\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
File created	C:\Windows\{70F34966-7DDF-4482-B7A5-81871F19109C}.exe	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
File created	C:\Windows\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe	{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
File created	C:\Windows\{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
File created	C:\Windows\{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
Token: SeIncBasePriorityPrivilege	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
Token: SeIncBasePriorityPrivilege	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
Token: SeIncBasePriorityPrivilege	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
Token: SeIncBasePriorityPrivilege	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
Token: SeIncBasePriorityPrivilege	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
Token: SeIncBasePriorityPrivilege	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
Token: SeIncBasePriorityPrivilege	1260	{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
Token: SeIncBasePriorityPrivilege	2772	{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
Token: SeIncBasePriorityPrivilege	596	{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2084	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	28
PID 2824 wrote to memory of 2084	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	28
PID 2824 wrote to memory of 2084	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	28
PID 2824 wrote to memory of 2084	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	28
PID 2824 wrote to memory of 2700	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	29
PID 2824 wrote to memory of 2700	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	29
PID 2824 wrote to memory of 2700	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	29
PID 2824 wrote to memory of 2700	2824	2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe	29
PID 2084 wrote to memory of 2856	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	30
PID 2084 wrote to memory of 2856	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	30
PID 2084 wrote to memory of 2856	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	30
PID 2084 wrote to memory of 2856	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	30
PID 2084 wrote to memory of 2592	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	31
PID 2084 wrote to memory of 2592	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	31
PID 2084 wrote to memory of 2592	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	31
PID 2084 wrote to memory of 2592	2084	{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe	31
PID 2856 wrote to memory of 1580	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	32
PID 2856 wrote to memory of 1580	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	32
PID 2856 wrote to memory of 1580	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	32
PID 2856 wrote to memory of 1580	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	32
PID 2856 wrote to memory of 1620	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	33
PID 2856 wrote to memory of 1620	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	33
PID 2856 wrote to memory of 1620	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	33
PID 2856 wrote to memory of 1620	2856	{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe	33
PID 1580 wrote to memory of 2428	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	36
PID 1580 wrote to memory of 2428	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	36
PID 1580 wrote to memory of 2428	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	36
PID 1580 wrote to memory of 2428	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	36
PID 1580 wrote to memory of 2528	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	37
PID 1580 wrote to memory of 2528	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	37
PID 1580 wrote to memory of 2528	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	37
PID 1580 wrote to memory of 2528	1580	{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe	37
PID 2428 wrote to memory of 1552	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	38
PID 2428 wrote to memory of 1552	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	38
PID 2428 wrote to memory of 1552	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	38
PID 2428 wrote to memory of 1552	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	38
PID 2428 wrote to memory of 2012	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	39
PID 2428 wrote to memory of 2012	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	39
PID 2428 wrote to memory of 2012	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	39
PID 2428 wrote to memory of 2012	2428	{151E943A-34F0-47e6-AA02-5CF472061F22}.exe	39
PID 1552 wrote to memory of 1848	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	40
PID 1552 wrote to memory of 1848	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	40
PID 1552 wrote to memory of 1848	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	40
PID 1552 wrote to memory of 1848	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	40
PID 1552 wrote to memory of 2028	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	41
PID 1552 wrote to memory of 2028	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	41
PID 1552 wrote to memory of 2028	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	41
PID 1552 wrote to memory of 2028	1552	{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe	41
PID 1848 wrote to memory of 2164	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	42
PID 1848 wrote to memory of 2164	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	42
PID 1848 wrote to memory of 2164	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	42
PID 1848 wrote to memory of 2164	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	42
PID 1848 wrote to memory of 2008	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	43
PID 1848 wrote to memory of 2008	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	43
PID 1848 wrote to memory of 2008	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	43
PID 1848 wrote to memory of 2008	1848	{B2722971-694C-4a30-B15A-6869B09D28E1}.exe	43
PID 2164 wrote to memory of 1260	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	44
PID 2164 wrote to memory of 1260	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	44
PID 2164 wrote to memory of 1260	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	44
PID 2164 wrote to memory of 1260	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	44
PID 2164 wrote to memory of 292	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	45
PID 2164 wrote to memory of 292	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	45
PID 2164 wrote to memory of 292	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	45
PID 2164 wrote to memory of 292	2164	{CB64D9D7-324D-411a-8E22-292493CA9363}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_92bbb4d66f3a73d4c4aa0f8fde9febbd_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
  C:\Windows\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
    C:\Windows\{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
      C:\Windows\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
        
        C:\Windows\{151E943A-34F0-47e6-AA02-5CF472061F22}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Windows\{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
        
        C:\Windows\{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
        
        C:\Windows\{B2722971-694C-4a30-B15A-6869B09D28E1}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
        
        C:\Windows\{CB64D9D7-324D-411a-8E22-292493CA9363}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
        
        C:\Windows\{70F34966-7DDF-4482-B7A5-81871F19109C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
        
        C:\Windows\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
        
        C:\Windows\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
        
        C:\Windows\{0038937B-D619-476f-8264-B6CEB0CCC001}.exe
        
        C:\Windows\{0038937B-D619-476f-8264-B6CEB0CCC001}.exe
        12⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A95CD~1.EXE > nul
        12⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5E748~1.EXE > nul
        11⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{70F34~1.EXE > nul
        10⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CB64D~1.EXE > nul
        9⤵
        
        PID:292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B2722~1.EXE > nul
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14A5F~1.EXE > nul
        7⤵
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{151E9~1.EXE > nul
        6⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{697FF~1.EXE > nul
        5⤵
        
        PID:2528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{34385~1.EXE > nul
      4⤵
      PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C7763~1.EXE > nul
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0038937B-D619-476f-8264-B6CEB0CCC001}.exe

Filesize
180KB

MD5
839d783005a8309126c81fa0b1da61e6

SHA1
ccdb3e2fdd943cc11ebad36ba49f460d61b95279

SHA256
54cf2ecb78a5d31d214679e73dbfd226346c0c2b302f3ef96bbefe5a52b2c5bd

SHA512
3ce43852458bb303c0da0ccfd553b0d3cb20202d782a6c53581128cfda60f79f6f67addd7c42c5f0c8c503adf0311b6d15f68a0664a49a1a6f038ea8353dfa2a

Download Submit
C:\Windows\{14A5F831-64B3-40bb-8F75-87B4E1E22397}.exe

Filesize
180KB

MD5
e826e980e335340273a1e37ace33bf8b

SHA1
37898b162b67ae348bbe35b3d7b9ae727262b660

SHA256
e64a9873b61b37a5291ce62137eb9cde2ab6ca2315db8b7abd302a1938f80a9c

SHA512
3c7d5542450460b45949c8f428da45bd138b402f9533966bbaea541a9f27e4a8bffae9a3f8775a775e869568ac77f9b27a7c37d414546f38255223e5f65ce3b3

Download Submit
C:\Windows\{151E943A-34F0-47e6-AA02-5CF472061F22}.exe

Filesize
180KB

MD5
ce0f2c528b44395451607e3b46223e46

SHA1
e7419cc4bb9c352f82d866e49dbc9154b63cb2f0

SHA256
3a54dff35269ad9f4cdf02e343909792e0aceb8e83f05a8164815e9b84775826

SHA512
889d65ec147f00b9e1793a9c0d2c941a4e9eb24380cd08897350fe10a0564abfa27c9011a25fecb218bfb0f58dc5ac8aafb1d99e5e017a873be85b2eceb75b66

Download Submit
C:\Windows\{3438502F-6CAB-44c0-B079-E8AB61874E72}.exe

Filesize
180KB

MD5
30b7fa6dc41b415b829277f150e07337

SHA1
3e9ddcbc1cfbe5da701a9dea1f70f792846827e8

SHA256
5b67dd8d7503a5fec0a4d3e01837d4fa1aa4a9f88dc8405b4d14064dc73ba39f

SHA512
110175a1fbed21ccd2fd26f911ea6be9d87fde79678eb353745702c33c1757a37b3ed8dff74aa4f901cff4fcf5c16930c65039eaa9d5d03785c306b13b9e5674

Download Submit
C:\Windows\{5E7489BB-51B9-4c18-870B-1CCB667DBBE2}.exe

Filesize
180KB

MD5
1d7f95be342d5303febea3fcbcf1808b

SHA1
de33f82d7605b0f2204acc2bee3d4a7cea394ee8

SHA256
f930f1befe651f22602161e6765e5ccde30b7243bd272287d568243e9fbbf614

SHA512
4895a2f5e16a789157b9bc0b6fc8243886a822b16d53559ccd8ec1110eab0216725cd22d93d1343eceefe546c088149b8038381ed9cf0a4dbae789a3a78d28ce

Download Submit
C:\Windows\{697FF5DE-135C-4e8f-8588-6A0D08A796F0}.exe

Filesize
180KB

MD5
6a60c3f4bd67d370e79101870fc7c48b

SHA1
be24c413e2098a31d1033385883359555c62f03a

SHA256
2a34282196c971372d4b9906f0f5f82b466940cae14ee1d2325cd0f6700dc55e

SHA512
37b5f90d057b56bfde08c7fa89bdd597e5ef395a674da4045ddc01cb5ac31b8220e038efdf2ea2a489d9dbdc1a43896efc31ec45a96d0472666fc997cdeb886c

Download Submit
C:\Windows\{70F34966-7DDF-4482-B7A5-81871F19109C}.exe

Filesize
180KB

MD5
3ece5a9dd73ba81332ec93441d691ac1

SHA1
24e68796cb1fb6300ca3eb4116a3765ce6b5c8b3

SHA256
63b390592a9cb69f91c9e49bc4e3d6ec796ecebd39e52107bcce32292360d672

SHA512
1c6d88bbce481fea19afc071c218b7ff93816fa16dd744f4f0d4bd8b7dd66c0207eff242d3699f36c81895f85f3f6f0e1735ba66255ba3249390fbb885360c02

Download Submit
C:\Windows\{A95CD6F4-CEF4-44d1-93BF-E29356B4E3A3}.exe

Filesize
180KB

MD5
ecfbba56dc3a9358faa1da39c477e738

SHA1
82778dcec9099b1afe65233241cbab71353df294

SHA256
2e583926ad639caaaddd89b5743e6647622766f3dd6c21f7f37c7816e743036c

SHA512
9652f2ce180daad1a24ee5aa0aeb29373d6593a8bb65f78fe3e01457fbc8b41a23a24f5d8427ac1b9598b10164e2fc6b1a1cca515b031afe7106bf0a790a19df

Download Submit
C:\Windows\{B2722971-694C-4a30-B15A-6869B09D28E1}.exe

Filesize
180KB

MD5
27f51aa7f9c99e02ddf07f1805f1c0d9

SHA1
683a461d4f8fd4662924204d0da0bcdee237f877

SHA256
46b828320ef0ffc0594875cfcdd921b4c16dc31d1c9cef8553732e45569ce633

SHA512
edb57398f09b76a388748bf6cf8ff60efe5fd745f0afd802c05da0184d63d75fdf3b7fe31ac6767bdec9f51a2573397686b1b3a353b45b2ad50bee38c004ae93

Download Submit
C:\Windows\{C7763EAF-7534-4654-91A2-DAA3FEBCAE87}.exe

Filesize
180KB

MD5
8d8fb1f3cac84914513157240e04201a

SHA1
8a037e6063a49bc25b9c4c716319b8b090ad86f4

SHA256
2a78f3579db22d5af548b775ab156fa141652245c6ba342de9550113fa57fb87

SHA512
f6d8c0e5b1c102e8b458b6c22e09b46c3a75af8f84d0995efa7f3c132a0029b7670698ebc4e897c3501ec1c63d5272fc3f0729ca3d8838302250dd46b8c00bd6

Download Submit
C:\Windows\{CB64D9D7-324D-411a-8E22-292493CA9363}.exe

Filesize
180KB

MD5
755997d28e23f5dc3d6999b4f2c79e2a

SHA1
19d57bc77e3010711d827ce1d3de61843d4459d7

SHA256
1b5f4beac1a37504fe4b0c841c836d179b1dec0eaaeaf43fed7c193b4c5f5aaa

SHA512
1e982ac47a3bf58c83241b631a38563170b6269fa5eee6e208431ba8c871ad8c46d8c582b6a7bf5f976ce4293f808546012686554be9b9d52f8cd1960c8e83a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads