19975872d0267d8105ab52d0d7be888383fdb14bcdc805a68943ff652bce6d1b

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
Size

168KB
MD5

b296bd4ce1594bb94c79728ed286031e
SHA1

8718116e6749231e24612ee28b16208760620d03
SHA256

19975872d0267d8105ab52d0d7be888383fdb14bcdc805a68943ff652bce6d1b
SHA512

a14c8c70a11be89da22c3685dd8f13f79b3125d5fe3b296bb6177ebc06164115bc9c83a62a6e38657cd39f71c067c9ec923f60fa72b0281e9aea83f90f75e263
SSDEEP

1536:1EGh0oLli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oLliOPOe2MUVg3Ve+rX

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001231a-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000013a3d-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e00000001231a-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0033000000013a7c-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f00000001231a-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001000000001231a-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x001100000001231a-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7DABE90B-F624-418b-8976-59B61ED4950B}	{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}\stubpath = "C:\\Windows\\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe"	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{159C712F-AC1A-4442-8E66-1E5D59093BFC}\stubpath = "C:\\Windows\\{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe"	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}\stubpath = "C:\\Windows\\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe"	{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86B6D98E-69C0-4024-9895-D755822FF024}	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}\stubpath = "C:\\Windows\\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe"	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{159C712F-AC1A-4442-8E66-1E5D59093BFC}	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}	{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}\stubpath = "C:\\Windows\\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe"	{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}\stubpath = "C:\\Windows\\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe"	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}\stubpath = "C:\\Windows\\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe"	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{86B6D98E-69C0-4024-9895-D755822FF024}\stubpath = "C:\\Windows\\{86B6D98E-69C0-4024-9895-D755822FF024}.exe"	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{165C4AB1-39AD-4d07-9D79-697003FBBD80}	{86B6D98E-69C0-4024-9895-D755822FF024}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{165C4AB1-39AD-4d07-9D79-697003FBBD80}\stubpath = "C:\\Windows\\{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe"	{86B6D98E-69C0-4024-9895-D755822FF024}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}\stubpath = "C:\\Windows\\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe"	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}	{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7DABE90B-F624-418b-8976-59B61ED4950B}\stubpath = "C:\\Windows\\{7DABE90B-F624-418b-8976-59B61ED4950B}.exe"	{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe

Deletes itself 1 IoCs

pid	Process
2552	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe
3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
1648	{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
2304	{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
876	{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
1504	{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
File created	C:\Windows\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
File created	C:\Windows\{7DABE90B-F624-418b-8976-59B61ED4950B}.exe	{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
File created	C:\Windows\{86B6D98E-69C0-4024-9895-D755822FF024}.exe	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
File created	C:\Windows\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
File created	C:\Windows\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
File created	C:\Windows\{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
File created	C:\Windows\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
File created	C:\Windows\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe	{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
File created	C:\Windows\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe	{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
File created	C:\Windows\{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	{86B6D98E-69C0-4024-9895-D755822FF024}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
Token: SeIncBasePriorityPrivilege	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe
Token: SeIncBasePriorityPrivilege	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
Token: SeIncBasePriorityPrivilege	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
Token: SeIncBasePriorityPrivilege	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
Token: SeIncBasePriorityPrivilege	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
Token: SeIncBasePriorityPrivilege	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
Token: SeIncBasePriorityPrivilege	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
Token: SeIncBasePriorityPrivilege	1648	{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
Token: SeIncBasePriorityPrivilege	2304	{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
Token: SeIncBasePriorityPrivilege	876	{7DABE90B-F624-418b-8976-59B61ED4950B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1712	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	28
PID 2112 wrote to memory of 1712	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	28
PID 2112 wrote to memory of 1712	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	28
PID 2112 wrote to memory of 1712	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	28
PID 2112 wrote to memory of 2552	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	29
PID 2112 wrote to memory of 2552	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	29
PID 2112 wrote to memory of 2552	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	29
PID 2112 wrote to memory of 2552	2112	2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe	29
PID 1712 wrote to memory of 3044	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	30
PID 1712 wrote to memory of 3044	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	30
PID 1712 wrote to memory of 3044	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	30
PID 1712 wrote to memory of 3044	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	30
PID 1712 wrote to memory of 2280	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	31
PID 1712 wrote to memory of 2280	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	31
PID 1712 wrote to memory of 2280	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	31
PID 1712 wrote to memory of 2280	1712	{86B6D98E-69C0-4024-9895-D755822FF024}.exe	31
PID 3044 wrote to memory of 2560	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	32
PID 3044 wrote to memory of 2560	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	32
PID 3044 wrote to memory of 2560	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	32
PID 3044 wrote to memory of 2560	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	32
PID 3044 wrote to memory of 2596	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	33
PID 3044 wrote to memory of 2596	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	33
PID 3044 wrote to memory of 2596	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	33
PID 3044 wrote to memory of 2596	3044	{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe	33
PID 2560 wrote to memory of 2376	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	36
PID 2560 wrote to memory of 2376	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	36
PID 2560 wrote to memory of 2376	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	36
PID 2560 wrote to memory of 2376	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	36
PID 2560 wrote to memory of 1452	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	37
PID 2560 wrote to memory of 1452	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	37
PID 2560 wrote to memory of 1452	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	37
PID 2560 wrote to memory of 1452	2560	{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe	37
PID 2376 wrote to memory of 2796	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	38
PID 2376 wrote to memory of 2796	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	38
PID 2376 wrote to memory of 2796	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	38
PID 2376 wrote to memory of 2796	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	38
PID 2376 wrote to memory of 2896	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	39
PID 2376 wrote to memory of 2896	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	39
PID 2376 wrote to memory of 2896	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	39
PID 2376 wrote to memory of 2896	2376	{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe	39
PID 2796 wrote to memory of 2024	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	40
PID 2796 wrote to memory of 2024	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	40
PID 2796 wrote to memory of 2024	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	40
PID 2796 wrote to memory of 2024	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	40
PID 2796 wrote to memory of 1828	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	41
PID 2796 wrote to memory of 1828	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	41
PID 2796 wrote to memory of 1828	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	41
PID 2796 wrote to memory of 1828	2796	{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe	41
PID 2024 wrote to memory of 1060	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	42
PID 2024 wrote to memory of 1060	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	42
PID 2024 wrote to memory of 1060	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	42
PID 2024 wrote to memory of 1060	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	42
PID 2024 wrote to memory of 2220	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	43
PID 2024 wrote to memory of 2220	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	43
PID 2024 wrote to memory of 2220	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	43
PID 2024 wrote to memory of 2220	2024	{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe	43
PID 1060 wrote to memory of 1648	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	44
PID 1060 wrote to memory of 1648	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	44
PID 1060 wrote to memory of 1648	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	44
PID 1060 wrote to memory of 1648	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	44
PID 1060 wrote to memory of 1692	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	45
PID 1060 wrote to memory of 1692	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	45
PID 1060 wrote to memory of 1692	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	45
PID 1060 wrote to memory of 1692	1060	{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_b296bd4ce1594bb94c79728ed286031e_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\{86B6D98E-69C0-4024-9895-D755822FF024}.exe
  C:\Windows\{86B6D98E-69C0-4024-9895-D755822FF024}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
    C:\Windows\{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
      C:\Windows\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
        
        C:\Windows\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Windows\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
        
        C:\Windows\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
        
        C:\Windows\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
        
        C:\Windows\{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
        
        C:\Windows\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
        
        C:\Windows\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
        
        C:\Windows\{7DABE90B-F624-418b-8976-59B61ED4950B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe
        
        C:\Windows\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe
        12⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7DABE~1.EXE > nul
        12⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85E7E~1.EXE > nul
        11⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A3860~1.EXE > nul
        10⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{159C7~1.EXE > nul
        9⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E8349~1.EXE > nul
        8⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E832B~1.EXE > nul
        7⤵
        
        PID:1828
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DC392~1.EXE > nul
        6⤵
        
        PID:2896
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{716FF~1.EXE > nul
        5⤵
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{165C4~1.EXE > nul
      4⤵
      PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{86B6D~1.EXE > nul
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{159C712F-AC1A-4442-8E66-1E5D59093BFC}.exe

Filesize
168KB

MD5
bb5153e1aa5b1db24d60b7eb8cefcb1b

SHA1
00dddaf0c0c59726558bdb5103a088c3a1fdf506

SHA256
5e6d68d9ba1bcc2c7fdb08baf2856b541e7ba5631fd1d80c4cf5bbc3b3a86fbb

SHA512
a847bc6eb0ce5c1e152b9442205529b9dd45c936539a36872278e0fcbf2989a5cd946dd60298a0961724f3166943c9c237d7a78f422acd7889e9dc20d845d6d9

Download Submit
C:\Windows\{165C4AB1-39AD-4d07-9D79-697003FBBD80}.exe

Filesize
168KB

MD5
281debae14079c886e89ad90e868b203

SHA1
13dedd9dab8950fb3eed8cf608e98c92566c30a6

SHA256
49376964e16a5f480fb0f41d2285bffa409ea17bc4637e1753a783c911b594ec

SHA512
8061757b8a042d0ca7989cfcaf6d928d9fe418d4cb697b74d06131fde6b6317a1f893eaab54388840cce6a997679fb4a788f76f32946f39020e997b48549b202

Download Submit
C:\Windows\{716FFBF3-A2A2-4f31-88A3-5D1B42EBA964}.exe

Filesize
168KB

MD5
2813f0b6a1db363e02a05d4e09e2f035

SHA1
a9a0be593734d0a02421f14813e2a997c1890f17

SHA256
343e7bf30fcfbc8703d83f21b958f3a5eddc334d596244580195db5f32149bb2

SHA512
6ebc894a60de631951c342dab9dba1a44cd9e6037f759f22f8b5621e115ab8c65f872ce737809708f4da29c74716662002c827fb7f54256e575517875b1d3d83

Download Submit
C:\Windows\{7DABE90B-F624-418b-8976-59B61ED4950B}.exe

Filesize
168KB

MD5
708dd775fc2df2b0cce12fccc1aef9d7

SHA1
cb2e42a3780db6561f6edb43f9b32efc022b1ae8

SHA256
c029dc40dfc4add6e5cfdc4dfa31b2997a89fe6b92832473369f4f2ea03d30ce

SHA512
7b14d0e5dbeb6a514b899ec5b2db965f33d95a3c9d5b0492f26ce3708429aa618e406124bd05662b1cf9c21653255bc1c656cba6dc37c558d6f1a0e4863d6794

Download Submit
C:\Windows\{85E7ED3A-B74B-454f-952D-7C5A03D17F22}.exe

Filesize
168KB

MD5
4811b2fead06fc548246c8539d88f25b

SHA1
97ce6069236b14a142a8e5947185a99c680a52e4

SHA256
9d4fa8764d114f77a802a17f651eee6b4f1c90bfce84e08ca122b6ae182c0c22

SHA512
6be9a03a105ea0033edeada8060af7d37163635edd2c48b62cbede3c2644936d72f48dfbf67469bcab07c26163cedfe7240b6d41308df4927ae1217f75fa8a2f

Download Submit
C:\Windows\{86B6D98E-69C0-4024-9895-D755822FF024}.exe

Filesize
168KB

MD5
c9d1744462de413a83e822ec58b01930

SHA1
382cb4f5275450f18f4fa4c6d3563fb094414f08

SHA256
b70db2027ad36e1b92ea5b392ab2ffd2276e70ad423871e7dfedaa48067c6429

SHA512
d917ab45af3bbe664ac073c8a13b9de6daec99a5d200c2bc0e427ba49fbf47dc6c89fa8ac54947511e722853b3ddc5dddd3eedc6e44868dca6e9cadded1cd5c3

Download Submit
C:\Windows\{A3860ED0-3043-4192-A8C9-53C7BF47DC01}.exe

Filesize
168KB

MD5
da7adeeba8a10bd6b505c924891f2620

SHA1
26caec873ead24432bb0e82abcd2715815ec0a9b

SHA256
fb2435b948abd6f12a2188bda6ce5b03d1f993e4c27ce09a82b63d70700d2ba4

SHA512
3cfedb9f339f1c7f709fde0c4f8f4d6e41532fdcae86d0291e89a932c17c7c9a8b42387670b76aea5666d15c66e34347eb5130fa4278c2cb2b5a9a80593fd9ee

Download Submit
C:\Windows\{BB9695D3-41D1-473e-A9BB-D01E9AA72AB5}.exe

Filesize
168KB

MD5
d945000b68c11a808c8533c73cb83642

SHA1
7ab39e3b7ab9910f0d45099f590b164edd789ae0

SHA256
8987e0729c54a167b1ed10321261cd9afa787acde2021d848fb0cc916497d0dd

SHA512
54596e5362ac2db8988b6496901058881e7df5f7382c5b8a1989336d04f61e997b68633a79f627ee0a7548226a304918aecb6d401471a5910bdccfefcf9d5b6d

Download Submit
C:\Windows\{DC392BC9-0C21-4f18-B620-989B27ACB9D8}.exe

Filesize
168KB

MD5
4377e819891ba5cca0f2db9d3eddf3a9

SHA1
243f3db4d2d7a97107aa094dbfbce2ade872b81d

SHA256
99c06cc5d1556e749c7ff6e3abd9cbed07894a836f2ff728fbea323871ad5847

SHA512
b0b99d3c0e4c2f58953a0308475ee1684712bde0bb0e1e8157f180f3fedecdcd0db89fe9d4bbb58a912f615fd12a5590a3f90504bb23486d7397215d91086167

Download Submit
C:\Windows\{E832B167-C60F-4315-860E-EB6CDAA4C3CB}.exe

Filesize
168KB

MD5
53fce2200a00140a5a91dca1a88c45ad

SHA1
381cb4d117aea9bf5433295ccf9ec5d5752c714e

SHA256
d60b7388156bdfc6be7f10af68605f162b6c55aa06795cbbc7e6b39dfcb69ad1

SHA512
937d475fcde4193f1f67f146124aa010a93a42d0c1acc2b0a72393325744332295017f41c62d8997d39e94450d8d6d58faefa15421eeb663b4ad3d53418da689

Download Submit
C:\Windows\{E834901C-C7B1-4dd3-9717-2E594C4FAD61}.exe

Filesize
168KB

MD5
e26d4b575212189eaecb8c43d0795289

SHA1
df56ee548bda10cc2cd1d21f35edba0c7de98aaa

SHA256
f9cc2950de0fccdc544e12fc3bcb8427c8b9145bc46e991a09fc7576dfb5fcc0

SHA512
332a804a753763f268c3576e0e8ceb3d9dce68174a22233b9bff1a36e665b288b6af9216eaee632f71e483fcfeb8060f1ca5130899691c9fbe8e46e30b52fb77

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads