3fc1c822ba7ffef39e13fd1a3e487fd94814b6eb28ecd7cde3ec8bd15847f07d

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe
Size

344KB
MD5

b135da0b77f928474d2ab56658d077bc
SHA1

44eeb9afd8d5e0adfe6740ca1685de1ae72656bb
SHA256

3fc1c822ba7ffef39e13fd1a3e487fd94814b6eb28ecd7cde3ec8bd15847f07d
SHA512

b8b3426ee532858e647204e283bd124d6712d6e8cfb3065d3f5882c400965d2c5c3509f50b5258770610645d361e3ab7ce45fa4aade1f60ad7a6346997501976
SSDEEP

3072:mEGh0oGlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGwlqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001225d-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000015d59-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d00000001225d-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001225d-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001225d-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001225d-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000001225d-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}\stubpath = "C:\\Windows\\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe"	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6A9424E-552C-4970-9046-D5854B396529}	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{84D4C71A-95ED-485d-9FA0-E449967EC06B}	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}\stubpath = "C:\\Windows\\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe"	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBE56526-15B5-414e-871C-E4F80E855AC1}	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}\stubpath = "C:\\Windows\\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe"	{A6A9424E-552C-4970-9046-D5854B396529}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48B6C59F-604A-4884-BF7A-165891426955}	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}\stubpath = "C:\\Windows\\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe"	{48B6C59F-604A-4884-BF7A-165891426955}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{004F33CA-D828-4369-9A55-D57FDAFC2247}\stubpath = "C:\\Windows\\{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe"	{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2AB36736-6752-4135-821B-CEE6EFE109EB}\stubpath = "C:\\Windows\\{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe"	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}	{48B6C59F-604A-4884-BF7A-165891426955}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}\stubpath = "C:\\Windows\\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe"	{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{004F33CA-D828-4369-9A55-D57FDAFC2247}	{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48B6C59F-604A-4884-BF7A-165891426955}\stubpath = "C:\\Windows\\{48B6C59F-604A-4884-BF7A-165891426955}.exe"	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBE56526-15B5-414e-871C-E4F80E855AC1}\stubpath = "C:\\Windows\\{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe"	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6A9424E-552C-4970-9046-D5854B396529}\stubpath = "C:\\Windows\\{A6A9424E-552C-4970-9046-D5854B396529}.exe"	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}	{A6A9424E-552C-4970-9046-D5854B396529}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{84D4C71A-95ED-485d-9FA0-E449967EC06B}\stubpath = "C:\\Windows\\{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe"	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}	{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2AB36736-6752-4135-821B-CEE6EFE109EB}	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe

Deletes itself 1 IoCs

pid	Process
2924	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe
2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
1700	{48B6C59F-604A-4884-BF7A-165891426955}.exe
1584	{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
1928	{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
2820	{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
File created	C:\Windows\{48B6C59F-604A-4884-BF7A-165891426955}.exe	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
File created	C:\Windows\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe	{48B6C59F-604A-4884-BF7A-165891426955}.exe
File created	C:\Windows\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe	{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
File created	C:\Windows\{A6A9424E-552C-4970-9046-D5854B396529}.exe	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
File created	C:\Windows\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	{A6A9424E-552C-4970-9046-D5854B396529}.exe
File created	C:\Windows\{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
File created	C:\Windows\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
File created	C:\Windows\{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe	{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
File created	C:\Windows\{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe
File created	C:\Windows\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
Token: SeIncBasePriorityPrivilege	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
Token: SeIncBasePriorityPrivilege	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
Token: SeIncBasePriorityPrivilege	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe
Token: SeIncBasePriorityPrivilege	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
Token: SeIncBasePriorityPrivilege	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
Token: SeIncBasePriorityPrivilege	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
Token: SeIncBasePriorityPrivilege	1700	{48B6C59F-604A-4884-BF7A-165891426955}.exe
Token: SeIncBasePriorityPrivilege	1584	{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
Token: SeIncBasePriorityPrivilege	1928	{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2200	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	28
PID 1740 wrote to memory of 2200	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	28
PID 1740 wrote to memory of 2200	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	28
PID 1740 wrote to memory of 2200	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	28
PID 1740 wrote to memory of 2924	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	29
PID 1740 wrote to memory of 2924	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	29
PID 1740 wrote to memory of 2924	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	29
PID 1740 wrote to memory of 2924	1740	2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe	29
PID 2200 wrote to memory of 2580	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	30
PID 2200 wrote to memory of 2580	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	30
PID 2200 wrote to memory of 2580	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	30
PID 2200 wrote to memory of 2580	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	30
PID 2200 wrote to memory of 2684	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	31
PID 2200 wrote to memory of 2684	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	31
PID 2200 wrote to memory of 2684	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	31
PID 2200 wrote to memory of 2684	2200	{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe	31
PID 2580 wrote to memory of 2436	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	32
PID 2580 wrote to memory of 2436	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	32
PID 2580 wrote to memory of 2436	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	32
PID 2580 wrote to memory of 2436	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	32
PID 2580 wrote to memory of 2708	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	33
PID 2580 wrote to memory of 2708	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	33
PID 2580 wrote to memory of 2708	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	33
PID 2580 wrote to memory of 2708	2580	{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe	33
PID 2436 wrote to memory of 2208	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	36
PID 2436 wrote to memory of 2208	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	36
PID 2436 wrote to memory of 2208	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	36
PID 2436 wrote to memory of 2208	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	36
PID 2436 wrote to memory of 3052	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	37
PID 2436 wrote to memory of 3052	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	37
PID 2436 wrote to memory of 3052	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	37
PID 2436 wrote to memory of 3052	2436	{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe	37
PID 2208 wrote to memory of 2528	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	38
PID 2208 wrote to memory of 2528	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	38
PID 2208 wrote to memory of 2528	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	38
PID 2208 wrote to memory of 2528	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	38
PID 2208 wrote to memory of 2740	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	39
PID 2208 wrote to memory of 2740	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	39
PID 2208 wrote to memory of 2740	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	39
PID 2208 wrote to memory of 2740	2208	{A6A9424E-552C-4970-9046-D5854B396529}.exe	39
PID 2528 wrote to memory of 2364	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	40
PID 2528 wrote to memory of 2364	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	40
PID 2528 wrote to memory of 2364	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	40
PID 2528 wrote to memory of 2364	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	40
PID 2528 wrote to memory of 2168	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	41
PID 2528 wrote to memory of 2168	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	41
PID 2528 wrote to memory of 2168	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	41
PID 2528 wrote to memory of 2168	2528	{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe	41
PID 2364 wrote to memory of 1980	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	42
PID 2364 wrote to memory of 1980	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	42
PID 2364 wrote to memory of 1980	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	42
PID 2364 wrote to memory of 1980	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	42
PID 2364 wrote to memory of 548	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	43
PID 2364 wrote to memory of 548	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	43
PID 2364 wrote to memory of 548	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	43
PID 2364 wrote to memory of 548	2364	{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe	43
PID 1980 wrote to memory of 1700	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	44
PID 1980 wrote to memory of 1700	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	44
PID 1980 wrote to memory of 1700	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	44
PID 1980 wrote to memory of 1700	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	44
PID 1980 wrote to memory of 604	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	45
PID 1980 wrote to memory of 604	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	45
PID 1980 wrote to memory of 604	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	45
PID 1980 wrote to memory of 604	1980	{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_b135da0b77f928474d2ab56658d077bc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
  C:\Windows\{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
    C:\Windows\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
      C:\Windows\{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\{A6A9424E-552C-4970-9046-D5854B396529}.exe
        
        C:\Windows\{A6A9424E-552C-4970-9046-D5854B396529}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2208
      - C:\Windows\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
        
        C:\Windows\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
        
        C:\Windows\{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
        
        C:\Windows\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\{48B6C59F-604A-4884-BF7A-165891426955}.exe
        
        C:\Windows\{48B6C59F-604A-4884-BF7A-165891426955}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
        
        C:\Windows\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
        
        C:\Windows\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
        
        C:\Windows\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe
        
        C:\Windows\{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe
        12⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3A876~1.EXE > nul
        12⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13B7D~1.EXE > nul
        11⤵
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48B6C~1.EXE > nul
        10⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E4F4~1.EXE > nul
        9⤵
        
        PID:604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84D4C~1.EXE > nul
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8BBD0~1.EXE > nul
        7⤵
        
        PID:2168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6A94~1.EXE > nul
        6⤵
        
        PID:2740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBE56~1.EXE > nul
        5⤵
        
        PID:3052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{48761~1.EXE > nul
      4⤵
      PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2AB36~1.EXE > nul
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{004F33CA-D828-4369-9A55-D57FDAFC2247}.exe

Filesize
344KB

MD5
668f13eb4ec4e32c226e054bb87bc79b

SHA1
f229ea12eb2cd10cdce5e9015121d41cadf8bb95

SHA256
1d9d5dc001f3c089b023d0fe6aa88664e69b7dac8914d4c834ae7a4270897c27

SHA512
1e22f622d1d8644ef9e82fd6131183bd9caf779acd9d664db54bb2c7122291fad73749a6b627ab261b8de4d9afeb2ace30ae2fb8695e7c5ce943ef3d94d2c404

Download Submit
C:\Windows\{13B7D7CD-C9CF-4992-8A94-3E3EB38F2972}.exe

Filesize
344KB

MD5
7b4d653ce81ba943a063e3b533a21e26

SHA1
b28ed7704bee42a40c32e06d071941629cbcee32

SHA256
72201f739b2e9e9ffe539d15e0a9450b0e69b7f6d1002d999a8a5ea12d640c8f

SHA512
ff2eb817ed1a076a0299bd0313ebd7dac6b06e1b66dc1bc84536e07593ccda62839c3a06ea07162c3a7cbc581664761fab3f66d983a965d6270ebea591a43424

Download Submit
C:\Windows\{2AB36736-6752-4135-821B-CEE6EFE109EB}.exe

Filesize
344KB

MD5
4395c5346eb967cf15ddf7e4e161a415

SHA1
57935a0729063d0ce422b31bb25fc4ee475d2f1c

SHA256
1304d71173e90ec2300ace1e5c03de35c073a1f0f6d6f0df39cb84f5cecdeaf1

SHA512
7aa5895d9da14426d2e21e524842cffccdde238d3c4495c7ed57eed948c193199d87a7968f1dde1cea108e57f33484770983bc5a57f8aaf0f8e0572d024b6d77

Download Submit
C:\Windows\{3A876D9C-BF93-43be-B4D8-01EEE36F88D9}.exe

Filesize
344KB

MD5
6f303ea12c22ca8ecdc55e60c7920655

SHA1
c6066a6adaa4001e4f6cfc2c8dff82efe5531423

SHA256
c2eade9939e9df121edc7ec207e9fce7f237a9bea11c8954a75d41dc50331ead

SHA512
de5f07de0815821beb92255dafed344445f33a7963d4bde7855745cf6414a04dd1ce88b6d18348c937eb54e69f367ee66e4c8d9277a622e4f8ce8c2ed9051a67

Download Submit
C:\Windows\{3E4F4613-FA29-43e7-B4AD-19C39A509DCA}.exe

Filesize
344KB

MD5
d6fb33b9c1141131cfe573012c5142c6

SHA1
4ada24880aef79876d0f4c85478d314255d9b7de

SHA256
7ede7457c00d474468cab63d34a168b08eaf85214e76a40fcc80a6149db6f37f

SHA512
abb54e3a1b88ff83aa7aa5f025590758061df6afd715949a2ccd23074ac9185a1130935cc385a1eff9c47d63eac9d34fecd5fa81446f2e77b3dc2fd68d9bef42

Download Submit
C:\Windows\{48761C6B-CF12-4bb9-BD89-F5A1DE2B26B4}.exe

Filesize
344KB

MD5
4cab1d9e3f500c6a255e593c9137e8d1

SHA1
a149e8ab44e60ec7852ba45f76cd26ea4ab99aa7

SHA256
489101f311d9f4e50fcb2af23c6f3db7fe4c67973e90004930a28b27306a1453

SHA512
b93ee62ba546337f8cb2895b0895d357ba0cc97ef81d6974e4338186b62012dee913cb33ecbaf6a0c249e5052e17b847fbd6fb7172af64a1993eb6755914a7ca

Download Submit
C:\Windows\{48B6C59F-604A-4884-BF7A-165891426955}.exe

Filesize
344KB

MD5
1606841259d589531f666c4b4d7a7c63

SHA1
a09c5481cfb00e4120adf4e05138a000dd15df11

SHA256
c9078708be17404bd6f896cc9d6973ac587a3d870716c1979a0170c0a6382103

SHA512
42f00d960b615d3dacd9488735ff7fae3233e9db26e55de302a354b4a627149a8f5e74cd9cf5608d549e84c00253e8778e126eca225b8499b8fbfbcddc4d9eca

Download Submit
C:\Windows\{84D4C71A-95ED-485d-9FA0-E449967EC06B}.exe

Filesize
344KB

MD5
085306a45dc3eedda21244a2987c1292

SHA1
96f6f7f34c6a3394174fa1dd46fa50f5080e49f6

SHA256
51b3f068a0a3ffca266cddc8f1607c6c1c6c3c10259a3a00b073ef4f3f1c60b9

SHA512
c3f1c837ab4d6af2cb0abe4635fac9a5bf899204063a56a2ca51bddf0d43930a7d2a3cb4b3289ad05b4a04b55fbb9cc16c8f78740c771961ac8e9d8d547253a9

Download Submit
C:\Windows\{8BBD018C-BB2B-4d30-B3C3-2FC6EFAC4730}.exe

Filesize
344KB

MD5
fda5e6f4866f4173103dd34217fb2e97

SHA1
737f7a80a2ca477f57030536e2d336cd6118df89

SHA256
407938cd89e83b366e356c06a5f42206b06210b38569ec2e13e922c6a086295a

SHA512
9462f641edf34cf5e438dd6366cba6e8bb08ab9320337ea0216e128ded4c256bf547a6136b3b6aff186ee16bac3baa9d9f25861a4cfd00cfd7dce20955ee3b17

Download Submit
C:\Windows\{A6A9424E-552C-4970-9046-D5854B396529}.exe

Filesize
344KB

MD5
cce86d700c5fa435605e3518cde488d3

SHA1
8349f57f6f92353cf7eaa1e15214a8a637555c71

SHA256
9812598bad1a9a504cf919a8ac7c0407fbb8e5b1906e4f78d1db5a647df4f970

SHA512
f55a8455e85ed579d2e55f142c32894efa8c0a85569101ec56e1b4e41282d77018dc80b9c522b2964fdefa0a3804dc1a280fd72c027ba4221d58d3106c284c64

Download Submit
C:\Windows\{CBE56526-15B5-414e-871C-E4F80E855AC1}.exe

Filesize
344KB

MD5
5ccc93a48045038bbea0959a42b9542b

SHA1
d95ded2acbf07d945e5a8f4f6aead634f5176a71

SHA256
3f4c53045d47dd9acf91c0210075cb3bceece8f4b07d9a0c6554c4b632c15327

SHA512
64e38f672992abda76e3deacc2c2193b67950eb07ad773bebbdb7249db953400b5dfdc94b99e527c97871c1616aa5c436a17831489f8513b0223f6382c8390a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads