5983d104d260c0ae6fd7a81f518f55fcb6865119330001897f6cc2a1b307fb0f

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
Size

408KB
MD5

d577f7e788fd9a50112955cf07553fcb
SHA1

5c42fc5a7ed19105d54d543c0fe9d71c3dfe15e6
SHA256

5983d104d260c0ae6fd7a81f518f55fcb6865119330001897f6cc2a1b307fb0f
SHA512

f1d115f2fa0678c7a7fc8b38aff74ef3b988424b3980989e7ffa033329a51c3bccbf9447d12c9b8dc808c7e776b771354385bba3170d264599ea67e82617a3ba
SSDEEP

3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBft:CEGoldOe2MUVg3vTeKcAEciTBqr3jy9

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122fa-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000015bfc-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f2-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000015bfc-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f2-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015bfc-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000000f6f2-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000015bfc-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000000f6f2-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000015bfc-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000000f6f2-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32641A59-BB22-4fbc-883C-17A83D52B2F2}\stubpath = "C:\\Windows\\{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe"	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}\stubpath = "C:\\Windows\\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe"	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}\stubpath = "C:\\Windows\\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe"	{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}	{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}\stubpath = "C:\\Windows\\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe"	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}	{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}\stubpath = "C:\\Windows\\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe"	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0E9444F-67DE-4226-A80A-2B8237C1F378}	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0E9444F-67DE-4226-A80A-2B8237C1F378}\stubpath = "C:\\Windows\\{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe"	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76CE152D-6F78-4a71-A05D-734DCF935152}	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2206B2B-E6FA-4223-9631-45F0223D0040}	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{32641A59-BB22-4fbc-883C-17A83D52B2F2}	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}\stubpath = "C:\\Windows\\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe"	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A2206B2B-E6FA-4223-9631-45F0223D0040}\stubpath = "C:\\Windows\\{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe"	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}	{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{76CE152D-6F78-4a71-A05D-734DCF935152}\stubpath = "C:\\Windows\\{76CE152D-6F78-4a71-A05D-734DCF935152}.exe"	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}\stubpath = "C:\\Windows\\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe"	{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}\stubpath = "C:\\Windows\\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe"	{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe

Deletes itself 1 IoCs

pid	Process
2812	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
2640	{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
1128	{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
1968	{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe
2856	{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
File created	C:\Windows\{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
File created	C:\Windows\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
File created	C:\Windows\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
File created	C:\Windows\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe	{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
File created	C:\Windows\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe	{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
File created	C:\Windows\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
File created	C:\Windows\{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
File created	C:\Windows\{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
File created	C:\Windows\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
File created	C:\Windows\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe	{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
Token: SeIncBasePriorityPrivilege	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
Token: SeIncBasePriorityPrivilege	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
Token: SeIncBasePriorityPrivilege	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
Token: SeIncBasePriorityPrivilege	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
Token: SeIncBasePriorityPrivilege	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
Token: SeIncBasePriorityPrivilege	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
Token: SeIncBasePriorityPrivilege	2640	{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
Token: SeIncBasePriorityPrivilege	1128	{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
Token: SeIncBasePriorityPrivilege	1968	{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2460	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	28
PID 2464 wrote to memory of 2460	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	28
PID 2464 wrote to memory of 2460	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	28
PID 2464 wrote to memory of 2460	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	28
PID 2464 wrote to memory of 2812	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	29
PID 2464 wrote to memory of 2812	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	29
PID 2464 wrote to memory of 2812	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	29
PID 2464 wrote to memory of 2812	2464	2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe	29
PID 2460 wrote to memory of 2484	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	30
PID 2460 wrote to memory of 2484	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	30
PID 2460 wrote to memory of 2484	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	30
PID 2460 wrote to memory of 2484	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	30
PID 2460 wrote to memory of 2576	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	31
PID 2460 wrote to memory of 2576	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	31
PID 2460 wrote to memory of 2576	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	31
PID 2460 wrote to memory of 2576	2460	{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe	31
PID 2484 wrote to memory of 2492	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	34
PID 2484 wrote to memory of 2492	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	34
PID 2484 wrote to memory of 2492	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	34
PID 2484 wrote to memory of 2492	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	34
PID 2484 wrote to memory of 2372	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	35
PID 2484 wrote to memory of 2372	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	35
PID 2484 wrote to memory of 2372	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	35
PID 2484 wrote to memory of 2372	2484	{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe	35
PID 2492 wrote to memory of 2908	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	36
PID 2492 wrote to memory of 2908	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	36
PID 2492 wrote to memory of 2908	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	36
PID 2492 wrote to memory of 2908	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	36
PID 2492 wrote to memory of 2920	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	37
PID 2492 wrote to memory of 2920	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	37
PID 2492 wrote to memory of 2920	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	37
PID 2492 wrote to memory of 2920	2492	{76CE152D-6F78-4a71-A05D-734DCF935152}.exe	37
PID 2908 wrote to memory of 676	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	38
PID 2908 wrote to memory of 676	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	38
PID 2908 wrote to memory of 676	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	38
PID 2908 wrote to memory of 676	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	38
PID 2908 wrote to memory of 556	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	39
PID 2908 wrote to memory of 556	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	39
PID 2908 wrote to memory of 556	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	39
PID 2908 wrote to memory of 556	2908	{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe	39
PID 676 wrote to memory of 2800	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	40
PID 676 wrote to memory of 2800	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	40
PID 676 wrote to memory of 2800	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	40
PID 676 wrote to memory of 2800	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	40
PID 676 wrote to memory of 2416	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	41
PID 676 wrote to memory of 2416	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	41
PID 676 wrote to memory of 2416	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	41
PID 676 wrote to memory of 2416	676	{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe	41
PID 2800 wrote to memory of 2364	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	42
PID 2800 wrote to memory of 2364	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	42
PID 2800 wrote to memory of 2364	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	42
PID 2800 wrote to memory of 2364	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	42
PID 2800 wrote to memory of 2692	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	43
PID 2800 wrote to memory of 2692	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	43
PID 2800 wrote to memory of 2692	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	43
PID 2800 wrote to memory of 2692	2800	{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe	43
PID 2364 wrote to memory of 2640	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	44
PID 2364 wrote to memory of 2640	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	44
PID 2364 wrote to memory of 2640	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	44
PID 2364 wrote to memory of 2640	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	44
PID 2364 wrote to memory of 2768	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	45
PID 2364 wrote to memory of 2768	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	45
PID 2364 wrote to memory of 2768	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	45
PID 2364 wrote to memory of 2768	2364	{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_d577f7e788fd9a50112955cf07553fcb_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
  C:\Windows\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
    C:\Windows\{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
      C:\Windows\{76CE152D-6F78-4a71-A05D-734DCF935152}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
        
        C:\Windows\{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Windows\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
        
        C:\Windows\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
        
        C:\Windows\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
        
        C:\Windows\{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
        
        C:\Windows\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
        
        C:\Windows\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
        
        C:\Windows\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe
        
        C:\Windows\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe
        
        C:\Windows\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe
        12⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5CCEC~1.EXE > nul
        12⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62B38~1.EXE > nul
        11⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13C39~1.EXE > nul
        10⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A2206~1.EXE > nul
        9⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3914~1.EXE > nul
        8⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59AF8~1.EXE > nul
        7⤵
        
        PID:2416
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{32641~1.EXE > nul
        6⤵
        
        PID:556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76CE1~1.EXE > nul
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D0E94~1.EXE > nul
      4⤵
      PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B887E~1.EXE > nul
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{13C39B95-FA19-4839-A4DF-D65BC5B710F8}.exe

Filesize
408KB

MD5
05d31ff2f6ef4d893ac6913d5e4f7956

SHA1
38ce710b640c2c79194f8d5d0b624a1a33c9f0be

SHA256
426e4b8cdb29fe6dc1175d8baf08046b3ecf389268a763689a5e495ca72503b7

SHA512
1cf8affe017ededa0044ddbd8af8defdfe3877b062857b85307b6e60682c03dbb2826be4e7cfdeeda8a957c4e58f6647ebd3cb1ebb39be8aa19e046030f8fac5

Download Submit
C:\Windows\{32641A59-BB22-4fbc-883C-17A83D52B2F2}.exe

Filesize
408KB

MD5
367d3b9e8680ff16052eee1ed7e82b91

SHA1
3087d60d8c8441ba41608df7d4093a5f7778cc4a

SHA256
46d81d3117643e16e17137af6fdf736b86cb72c56c382bb8b15ff6654854c841

SHA512
5eb7c9d8d0511721c0137d4b46327363e0ea2fc3c8a31f3949850c6d5adb1cd556cb1444a58b07eb74c42cdf67f0ea980ebba6698086c64e39bd002930a912bf

Download Submit
C:\Windows\{59AF87A8-247C-4eba-A510-59DE3E07FD7C}.exe

Filesize
408KB

MD5
8f65e51d45885e6107ec2eb0111cc181

SHA1
ba57184dbfabb7ae5bf5e775165b2f4f24aab6d0

SHA256
bd2c1a58dde1ae8cf15d0c0f1262d9a792a993eedd2305d17d2e15e05abe861f

SHA512
c3056a676b86203614bf52f88d87321686f7a04679e1b482d882e901fe0f7eb9bfdd0a16144e6e31adbee61e282d7542ae77ecd7940b041574c349ea5f7050e3

Download Submit
C:\Windows\{5CCEC6A6-6193-4d79-A1E4-7D1D5B2C4F2B}.exe

Filesize
408KB

MD5
95cb82de267d3cf3a565043f9c9b599e

SHA1
960e41054fbfc2709bd6f3dcfdc6d661889f32e4

SHA256
84a17aa5232df8378a091384ff31822042bb062e77f8212d74f16dad1beb247d

SHA512
3d7490adea08725d38f03fce94825b6b55b540ce53315e2f0a90115a8fab54c248a057616df3f61e19e8c67aef6cf1fbad2b6c5fb3c6d6f7fa1ababda56e9ecc

Download Submit
C:\Windows\{62B38583-BBE4-4af1-B16D-0BF4AB82711B}.exe

Filesize
408KB

MD5
71e8e806b051df5e63fb65b43912a2a1

SHA1
5f469b87188f192c5c39bc19cee0c0d7f9ad784e

SHA256
5c4169fb06ba786a8fad5553a529857943fad132ac4778fdc25ab9131112b51a

SHA512
9150038305602aaeceb0aa692d2aa7e40478186ed80e3c6ecd5d555606b0ed7049521cb567cda0b8cc320b73174ef1eca8a584ffb4253026d7bedcfdcebfad30

Download Submit
C:\Windows\{76CE152D-6F78-4a71-A05D-734DCF935152}.exe

Filesize
408KB

MD5
86c85b72fb45fb07e15b8b63d8bb2e14

SHA1
24386303979fd8ee51dabcebd60c5e489e04fba5

SHA256
54ff6aa23b2da11c25e11318b94ca7a41ae78dce11c1aefc7e8fa1134d8fc48c

SHA512
04fffa67bd49a2e7daa576303d2364ac13e072a38a78785b757f026531256faca8e1f39ff023d7d389fbc0aa3e65fb0bdb0e39f7e29de8a0463bf87d10c31fff

Download Submit
C:\Windows\{A2206B2B-E6FA-4223-9631-45F0223D0040}.exe

Filesize
408KB

MD5
deca2ae6d066388e8856157a6efa8ed8

SHA1
8989349ce7ed83ada665519499f9d6c6666997f2

SHA256
49247657b1d09413c2775a31c83b57cce744c26152586d2f6387eafa42f69690

SHA512
08e5790ff69c1beb3e65ab2c3113986197509267a36138afb2fe18818b08fc11ff827167fad57cb0b3315a83cca3c06f34fc4412781328e7b0e46b6f4b4759e1

Download Submit
C:\Windows\{B887E73E-EFF2-45b1-A34B-05C780C33E7B}.exe

Filesize
408KB

MD5
3dde660f1dd77480cfc5656d304b5d63

SHA1
da701bcd65d616c46e89df04fa37a234bd0c11e4

SHA256
021dba3be3a3959b77e4fd0e3ac8c5465bb6985d67606e18e9529c1c8b88ab7e

SHA512
e2eb5bdc9de1ed52bec1d8d1ca7d5b4bbd93b104899f057bef2dbf3ced1b1dbc0ac21f4e3975c8bdf3d07490bbdabe2c8b53219e5dafb90299c797c4ac10e061

Download Submit
C:\Windows\{C39149C7-1448-49a2-AFCA-3E4D13B9F901}.exe

Filesize
408KB

MD5
8a50a01776bcfc295140b984949133f9

SHA1
49f9cfff9dd2e4482aee518a4fcd02ecb7484e2e

SHA256
b6a50378f482139531694bb0237fb9d3053c2e0efc4061f33a27656f9f876b31

SHA512
275ff9f2b4efb749eb566536ee8e4c8a3bdb6bea04ccaef5a67d061cee6fe999b21696b3e2dbcbff158c669f6e0d4329bae46f71e4dcc4e82edf5c7fb1128ca7

Download Submit
C:\Windows\{D0E9444F-67DE-4226-A80A-2B8237C1F378}.exe

Filesize
408KB

MD5
bc13bb704c5a073fcede4390d04ae469

SHA1
305c5017c494d102c8f17dff6d4ab9dea4aafc2a

SHA256
130999e8e1b3a579d9fa598b584e88a93e47f60c1b56a4af74f327d6b8b14786

SHA512
0791e600b887bf8482f0ec07da10001f81f2f344d2bf95e62f0b451d56ed3090e09a8f451281ca6d7614eefe48455b76c53586b012a3f1c7277d3379b6a34c79

Download Submit
C:\Windows\{D3503E0E-C4FF-4a63-91C7-056CA08C15B7}.exe

Filesize
408KB

MD5
1f97cbf278964b5b82a4f7d166126465

SHA1
e7d49b16102a61b4f93e442b89034fda7a8a8029

SHA256
d39dfda11d7e05cf305fd557d87709d3982f90fd07e902f8dbf66ad5d342a2c4

SHA512
b53997e48ba2747e79a66c0c59096eddc939cedb5cd63a20e262d4faafe94a842636f74d8a4396bd9d421c1cca571c6aeca0e2d4255f30ed70886829a30c1c6f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads