32929b60e13a23f86b88b99c636d46be9104fc21becfddd5e990bfaa2f22e4f6

Analysis

max time kernel
144s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
Size

344KB
MD5

87aca315993ef818fd1113e829cbffc2
SHA1

5ba0239362967c16fdc9ae8d94e9a5b72950cad0
SHA256

32929b60e13a23f86b88b99c636d46be9104fc21becfddd5e990bfaa2f22e4f6
SHA512

cb6c9a5ea0cb0a086f26057645498eb7c37b94109bb15878bc483a68e55ee561c7064946b51e8e55f2b6bd261b2709e5aa64f94a47be27678aebe02ae124414f
SSDEEP

3072:mEGh0oklEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGelqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130fc-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000016cca-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000016ce6-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000016d12-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0010000000016ce6-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000016d12-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0011000000016ce6-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000016d12-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0012000000016ce6-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000016d22-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}\stubpath = "C:\\Windows\\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe"	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C8C4575-249B-40fa-B644-ED1BC495F810}\stubpath = "C:\\Windows\\{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe"	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}\stubpath = "C:\\Windows\\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe"	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73450521-D54F-4701-9C84-C663DDDA84CD}\stubpath = "C:\\Windows\\{73450521-D54F-4701-9C84-C663DDDA84CD}.exe"	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{646E1C95-9618-4d7f-9D18-B330AC901292}\stubpath = "C:\\Windows\\{646E1C95-9618-4d7f-9D18-B330AC901292}.exe"	{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B44F951-E0F4-4afe-B097-246EFA626202}\stubpath = "C:\\Windows\\{3B44F951-E0F4-4afe-B097-246EFA626202}.exe"	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}\stubpath = "C:\\Windows\\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe"	{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{646E1C95-9618-4d7f-9D18-B330AC901292}	{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}\stubpath = "C:\\Windows\\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe"	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3B44F951-E0F4-4afe-B097-246EFA626202}	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C8C4575-249B-40fa-B644-ED1BC495F810}	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}\stubpath = "C:\\Windows\\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe"	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}	{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{073D3023-FE38-4b85-AA01-E411681D3C68}	{646E1C95-9618-4d7f-9D18-B330AC901292}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}\stubpath = "C:\\Windows\\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe"	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{73450521-D54F-4701-9C84-C663DDDA84CD}	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{073D3023-FE38-4b85-AA01-E411681D3C68}\stubpath = "C:\\Windows\\{073D3023-FE38-4b85-AA01-E411681D3C68}.exe"	{646E1C95-9618-4d7f-9D18-B330AC901292}.exe

Deletes itself 1 IoCs

pid	Process
2704	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
2628	{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
308	{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
624	{646E1C95-9618-4d7f-9D18-B330AC901292}.exe
2372	{073D3023-FE38-4b85-AA01-E411681D3C68}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
File created	C:\Windows\{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
File created	C:\Windows\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
File created	C:\Windows\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
File created	C:\Windows\{73450521-D54F-4701-9C84-C663DDDA84CD}.exe	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
File created	C:\Windows\{646E1C95-9618-4d7f-9D18-B330AC901292}.exe	{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
File created	C:\Windows\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
File created	C:\Windows\{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
File created	C:\Windows\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
File created	C:\Windows\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe	{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
File created	C:\Windows\{073D3023-FE38-4b85-AA01-E411681D3C68}.exe	{646E1C95-9618-4d7f-9D18-B330AC901292}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
Token: SeIncBasePriorityPrivilege	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
Token: SeIncBasePriorityPrivilege	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
Token: SeIncBasePriorityPrivilege	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
Token: SeIncBasePriorityPrivilege	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
Token: SeIncBasePriorityPrivilege	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
Token: SeIncBasePriorityPrivilege	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
Token: SeIncBasePriorityPrivilege	2628	{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
Token: SeIncBasePriorityPrivilege	308	{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
Token: SeIncBasePriorityPrivilege	624	{646E1C95-9618-4d7f-9D18-B330AC901292}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3028	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	28
PID 2848 wrote to memory of 3028	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	28
PID 2848 wrote to memory of 3028	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	28
PID 2848 wrote to memory of 3028	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	28
PID 2848 wrote to memory of 2704	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	29
PID 2848 wrote to memory of 2704	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	29
PID 2848 wrote to memory of 2704	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	29
PID 2848 wrote to memory of 2704	2848	2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe	29
PID 3028 wrote to memory of 2548	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	30
PID 3028 wrote to memory of 2548	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	30
PID 3028 wrote to memory of 2548	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	30
PID 3028 wrote to memory of 2548	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	30
PID 3028 wrote to memory of 2532	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	31
PID 3028 wrote to memory of 2532	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	31
PID 3028 wrote to memory of 2532	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	31
PID 3028 wrote to memory of 2532	3028	{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe	31
PID 2548 wrote to memory of 2944	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	34
PID 2548 wrote to memory of 2944	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	34
PID 2548 wrote to memory of 2944	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	34
PID 2548 wrote to memory of 2944	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	34
PID 2548 wrote to memory of 520	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	35
PID 2548 wrote to memory of 520	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	35
PID 2548 wrote to memory of 520	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	35
PID 2548 wrote to memory of 520	2548	{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe	35
PID 2944 wrote to memory of 436	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	36
PID 2944 wrote to memory of 436	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	36
PID 2944 wrote to memory of 436	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	36
PID 2944 wrote to memory of 436	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	36
PID 2944 wrote to memory of 1108	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	37
PID 2944 wrote to memory of 1108	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	37
PID 2944 wrote to memory of 1108	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	37
PID 2944 wrote to memory of 1108	2944	{3B44F951-E0F4-4afe-B097-246EFA626202}.exe	37
PID 436 wrote to memory of 2772	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	38
PID 436 wrote to memory of 2772	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	38
PID 436 wrote to memory of 2772	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	38
PID 436 wrote to memory of 2772	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	38
PID 436 wrote to memory of 2792	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	39
PID 436 wrote to memory of 2792	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	39
PID 436 wrote to memory of 2792	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	39
PID 436 wrote to memory of 2792	436	{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe	39
PID 2772 wrote to memory of 2512	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	40
PID 2772 wrote to memory of 2512	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	40
PID 2772 wrote to memory of 2512	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	40
PID 2772 wrote to memory of 2512	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	40
PID 2772 wrote to memory of 2028	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	41
PID 2772 wrote to memory of 2028	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	41
PID 2772 wrote to memory of 2028	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	41
PID 2772 wrote to memory of 2028	2772	{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe	41
PID 2512 wrote to memory of 2384	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	42
PID 2512 wrote to memory of 2384	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	42
PID 2512 wrote to memory of 2384	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	42
PID 2512 wrote to memory of 2384	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	42
PID 2512 wrote to memory of 2484	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	43
PID 2512 wrote to memory of 2484	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	43
PID 2512 wrote to memory of 2484	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	43
PID 2512 wrote to memory of 2484	2512	{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe	43
PID 2384 wrote to memory of 2628	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	44
PID 2384 wrote to memory of 2628	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	44
PID 2384 wrote to memory of 2628	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	44
PID 2384 wrote to memory of 2628	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	44
PID 2384 wrote to memory of 1808	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	45
PID 2384 wrote to memory of 1808	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	45
PID 2384 wrote to memory of 1808	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	45
PID 2384 wrote to memory of 1808	2384	{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_87aca315993ef818fd1113e829cbffc2_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
  C:\Windows\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
    C:\Windows\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
      C:\Windows\{3B44F951-E0F4-4afe-B097-246EFA626202}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
        
        C:\Windows\{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:436
      - C:\Windows\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
        
        C:\Windows\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
        
        C:\Windows\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
        
        C:\Windows\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
        
        C:\Windows\{73450521-D54F-4701-9C84-C663DDDA84CD}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
        
        C:\Windows\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:308
        
        C:\Windows\{646E1C95-9618-4d7f-9D18-B330AC901292}.exe
        
        C:\Windows\{646E1C95-9618-4d7f-9D18-B330AC901292}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
        
        C:\Windows\{073D3023-FE38-4b85-AA01-E411681D3C68}.exe
        
        C:\Windows\{073D3023-FE38-4b85-AA01-E411681D3C68}.exe
        12⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{646E1~1.EXE > nul
        12⤵
        
        PID:836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3D6F8~1.EXE > nul
        11⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{73450~1.EXE > nul
        10⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B11C3~1.EXE > nul
        9⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99AE9~1.EXE > nul
        8⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5FF83~1.EXE > nul
        7⤵
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C8C4~1.EXE > nul
        6⤵
        
        PID:2792
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3B44F~1.EXE > nul
        5⤵
        
        PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{EEDDF~1.EXE > nul
      4⤵
      PID:520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CEECE~1.EXE > nul
    3⤵
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{073D3023-FE38-4b85-AA01-E411681D3C68}.exe

Filesize
344KB

MD5
383175cd3cd323fa1ff3917f3d1dc68d

SHA1
2f5cb39d2b391f65f66137e4f90a14cd2bc89ce2

SHA256
f3e290aa78f4ecb8df5f1959f84c630bca72dcef6e7ca230062a4eba6cffc558

SHA512
008cd4d423fc281e8da809d3d7dc441522f0d0d7ed76ed76893f79dd376bc9e396f0a16c3a3f687740377820a5affce43a45ef898fd668ab056947eb2023846f

Download Submit
C:\Windows\{3B44F951-E0F4-4afe-B097-246EFA626202}.exe

Filesize
344KB

MD5
bf8e4486020780c35e1c08784b39432d

SHA1
2e0fafe8db18089ad7ea40072a05533e11940a55

SHA256
f20482a8d58e33da561cf8e70774c37b4ca13fb8c999392f1ab9ff63bbcc2ee2

SHA512
6533118051f3be4a53b66b0fceccd4f6a48cf682b46e3a4e1550ba3d3936378e8d6a01fd83f5dffb3ea4ae5f4d5e90c0922d830a79d59f98bec1a09fae89fa80

Download Submit
C:\Windows\{3C8C4575-249B-40fa-B644-ED1BC495F810}.exe

Filesize
344KB

MD5
a105032b3356c4d948261d163e07bdf9

SHA1
8724a760111e6084372c5d650f022f9535f3078e

SHA256
e8146ff0695f14cbd8485d3ec56a90cb9341497e5dfbea95db0b2314ff639da7

SHA512
5834b43ea9a1d26e6d7e1d76a8483f5a98862a6fc8c3a3c6413d04dc77223e493fbb7ae12070d54959e8242ecec8954afe2392876c266f72d13d852d725ebf40

Download Submit
C:\Windows\{3D6F8384-F7D8-41bf-BC4B-BF2020CA5F57}.exe

Filesize
344KB

MD5
f4cff380a753e147555e4c8abb7a528b

SHA1
5fd4a7a3d39d2491efcfcca35772cefe107bee5f

SHA256
caa8b31cb60c2890241bf7964e68bd11b421bfebe48e7cb0c3dee191f3b11ec5

SHA512
9921ad248dee47698c8d3a3b3584cce66c9b9b626cdae2be876ad55cdfc7ddd9ae62f6bf2bade0078041c08831672f481217536592795459034dc0bdf0c4a289

Download Submit
C:\Windows\{5FF83B8B-0787-4428-B567-2CDADEF5FAAE}.exe

Filesize
344KB

MD5
0bd5249364a301b18bf45b3e2de9dc3b

SHA1
6ddf785d1c015077c430f998ae49fa0515a51cda

SHA256
170cff8e4ff55907d53d9da5a62964009af16700dbfb6d4e9289df2d52065b81

SHA512
caa855877cc26b8600c18e0a1a8ef5cf172a5351d0451d2a8825d9de25ee2458200e251e1e3c957821f5275162f9773812e5245e55c9c07d057410b3bc38ddd9

Download Submit
C:\Windows\{646E1C95-9618-4d7f-9D18-B330AC901292}.exe

Filesize
344KB

MD5
72315685d15c4b666654e819bf54e996

SHA1
98db43035c8ca330d6bc65330847724bbf7ebf4e

SHA256
b8e9c7e2f1ff1f3e683e538f6cbb48a777bf44fe7ed0912f7a124b0a4cc2d932

SHA512
f9a44efdd081acec3338cd11db7f4ca349b95d07b22a2daf62774e3221a25fc24ef1f9886a9569a45c9b45f0a38ba95e266baee9b25117f5f211bfdd558b15eb

Download Submit
C:\Windows\{73450521-D54F-4701-9C84-C663DDDA84CD}.exe

Filesize
344KB

MD5
5e5a835b7f272429e7b904cf267f13c2

SHA1
da7f551b3220e5a76f82bc08974eaadf350176ec

SHA256
54f092aae6a87f5797ba3ebb4e3a7d8919e17ac89a6f23063aaad1c3a52408d5

SHA512
151b85eeaf3b085fd2b293090a7175f5ac5874d200fedc626d074ca88bef6dcf5513902108640fe0ec33defeb8f9b6dc195e9062b1545982f2307a634b763f4e

Download Submit
C:\Windows\{99AE9427-18A2-4779-BFF8-A53C87A1ECBD}.exe

Filesize
344KB

MD5
74f7dabd25b9365a33eec8d3f18d7ac7

SHA1
d211d5a2bd82a2a6278df83cff871cb32ab1b9c3

SHA256
463cb6d31c89f543bf4c8d1eddeb52756a90feeff66d5dd28d6ba65d4dd2dc57

SHA512
72d927b1a68f99bb43c545150e11e6d39d8ef0b6b3168983e1e7a17eb51a3b2741519713cb28f74ab00c4a13e1a0603d28b992421a4aba9a6d0f287e2df4fb53

Download Submit
C:\Windows\{B11C3B18-60DA-41bc-BCB1-3FDA8F44A51A}.exe

Filesize
344KB

MD5
b2cb6b87afa2cf8f43e748e63357a68f

SHA1
cafa4a242456b0da73e5dbeecf5959472fb6760b

SHA256
6f289e2d83b60d565d158a28fa448e3cc9ac9ddfc741bf820cd63393d57693da

SHA512
736301f140120a99acf502f816eda7b4fce030d29fd149c7bbb3a539db3469c1e3c70fb127ab25f2e824159a6abca5f78b9ba64f06aeeeefe867def49cfdc395

Download Submit
C:\Windows\{CEECECF1-875C-4ab6-B320-8DFF13968C1F}.exe

Filesize
344KB

MD5
cfd8f2d4df120d5a15f2ecab6deb87a5

SHA1
dc66b17e842d390dd551ab141c79766786e55ae0

SHA256
5568587824f0b1375339acce1ec3d7611fd93bcf5f6687a4bab9f2eb6ad3164a

SHA512
b05f7d8229ebb7892b258e1e88133bfd82e27d252134679291491e5f3cd6af5d0751fde6b8f059bb168fcb3ffecdbe81831baf12c39902a23d9155f705f66b5d

Download Submit
C:\Windows\{EEDDF394-67B0-4ea1-9841-F54AF50313EC}.exe

Filesize
344KB

MD5
20fcbfc98fcdc5cce0084d2683484e9b

SHA1
d8498266b94e26d0994d27b28ff62bedabda440e

SHA256
d0365715728ddc4da54bfe188fcb9a2e6771189aa8f25752ac79b4c62e169565

SHA512
ce2385616c6a67b53d394f70de02e34788ed8f3dc857615fa0b3100f6626a85e410c36b0467c0489613d6ad73ced6f38a5814e5b6b51cf3fa7eb891394b96c8f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads