e8029b194babd0106583948b6e58e32883f41e810fcb0ba6b3ea618a5d71fe1c

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
Size

344KB
MD5

23fee02cea008ff828bcb75854cf4e73
SHA1

31df05150de8adad5366c6e4138b860238eede8e
SHA256

e8029b194babd0106583948b6e58e32883f41e810fcb0ba6b3ea618a5d71fe1c
SHA512

1dac5b53077ee93501a6ba03b922359df82063274049af0daea0768542768962bfbe722d2df15080728303fc1f6b033853a59567bceb908de8568d22bbbd6d35
SSDEEP

3072:mEGh0omlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGolqOe2MUVg3v2IneKcAEcA

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b000000014454-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c000000012256-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0037000000014708-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000d000000012256-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0005000000004ed7-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000e000000012256-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000004ed7-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000f000000012256-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000004ed7-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA906831-5017-4344-AC83-37AF7C4F1C0C}	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10DD9DA0-3218-488d-BA31-8EF90320A001}	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33DB41CC-64AF-4479-B715-6F8292EA11A4}\stubpath = "C:\\Windows\\{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe"	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97961CF5-37D0-4f58-81E7-0C488A823B41}	{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAB5B193-77DB-4b9c-8114-16BB2156160B}	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAB5B193-77DB-4b9c-8114-16BB2156160B}\stubpath = "C:\\Windows\\{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe"	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10DD9DA0-3218-488d-BA31-8EF90320A001}\stubpath = "C:\\Windows\\{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe"	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{33DB41CC-64AF-4479-B715-6F8292EA11A4}	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}\stubpath = "C:\\Windows\\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe"	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}\stubpath = "C:\\Windows\\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe"	{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}\stubpath = "C:\\Windows\\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe"	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{97961CF5-37D0-4f58-81E7-0C488A823B41}\stubpath = "C:\\Windows\\{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe"	{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{92A3BC20-353F-4df5-96F9-98F6251D64AD}	{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}\stubpath = "C:\\Windows\\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe"	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8815EF97-83A0-4363-B7F4-FF418844A65F}	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8815EF97-83A0-4363-B7F4-FF418844A65F}\stubpath = "C:\\Windows\\{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe"	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{92A3BC20-353F-4df5-96F9-98F6251D64AD}\stubpath = "C:\\Windows\\{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe"	{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}	{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BA906831-5017-4344-AC83-37AF7C4F1C0C}\stubpath = "C:\\Windows\\{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe"	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe

Deletes itself 1 IoCs

pid	Process
2608	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
1264	{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
1888	{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
580	{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe
2236	{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
File created	C:\Windows\{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
File created	C:\Windows\{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
File created	C:\Windows\{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
File created	C:\Windows\{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
File created	C:\Windows\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
File created	C:\Windows\{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe	{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
File created	C:\Windows\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
File created	C:\Windows\{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
File created	C:\Windows\{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe	{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
File created	C:\Windows\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe	{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
Token: SeIncBasePriorityPrivilege	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
Token: SeIncBasePriorityPrivilege	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
Token: SeIncBasePriorityPrivilege	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
Token: SeIncBasePriorityPrivilege	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
Token: SeIncBasePriorityPrivilege	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
Token: SeIncBasePriorityPrivilege	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
Token: SeIncBasePriorityPrivilege	1264	{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
Token: SeIncBasePriorityPrivilege	1888	{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
Token: SeIncBasePriorityPrivilege	580	{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2548	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	28
PID 2168 wrote to memory of 2548	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	28
PID 2168 wrote to memory of 2548	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	28
PID 2168 wrote to memory of 2548	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	28
PID 2168 wrote to memory of 2608	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	29
PID 2168 wrote to memory of 2608	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	29
PID 2168 wrote to memory of 2608	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	29
PID 2168 wrote to memory of 2608	2168	2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe	29
PID 2548 wrote to memory of 2032	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	30
PID 2548 wrote to memory of 2032	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	30
PID 2548 wrote to memory of 2032	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	30
PID 2548 wrote to memory of 2032	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	30
PID 2548 wrote to memory of 2440	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	31
PID 2548 wrote to memory of 2440	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	31
PID 2548 wrote to memory of 2440	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	31
PID 2548 wrote to memory of 2440	2548	{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe	31
PID 2032 wrote to memory of 2520	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	32
PID 2032 wrote to memory of 2520	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	32
PID 2032 wrote to memory of 2520	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	32
PID 2032 wrote to memory of 2520	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	32
PID 2032 wrote to memory of 2416	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	33
PID 2032 wrote to memory of 2416	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	33
PID 2032 wrote to memory of 2416	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	33
PID 2032 wrote to memory of 2416	2032	{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe	33
PID 2520 wrote to memory of 2776	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	36
PID 2520 wrote to memory of 2776	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	36
PID 2520 wrote to memory of 2776	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	36
PID 2520 wrote to memory of 2776	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	36
PID 2520 wrote to memory of 2844	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	37
PID 2520 wrote to memory of 2844	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	37
PID 2520 wrote to memory of 2844	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	37
PID 2520 wrote to memory of 2844	2520	{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe	37
PID 2776 wrote to memory of 2684	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	38
PID 2776 wrote to memory of 2684	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	38
PID 2776 wrote to memory of 2684	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	38
PID 2776 wrote to memory of 2684	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	38
PID 2776 wrote to memory of 1564	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	39
PID 2776 wrote to memory of 1564	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	39
PID 2776 wrote to memory of 1564	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	39
PID 2776 wrote to memory of 1564	2776	{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe	39
PID 2684 wrote to memory of 2664	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	40
PID 2684 wrote to memory of 2664	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	40
PID 2684 wrote to memory of 2664	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	40
PID 2684 wrote to memory of 2664	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	40
PID 2684 wrote to memory of 2644	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	41
PID 2684 wrote to memory of 2644	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	41
PID 2684 wrote to memory of 2644	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	41
PID 2684 wrote to memory of 2644	2684	{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe	41
PID 2664 wrote to memory of 2772	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	42
PID 2664 wrote to memory of 2772	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	42
PID 2664 wrote to memory of 2772	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	42
PID 2664 wrote to memory of 2772	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	42
PID 2664 wrote to memory of 1904	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	43
PID 2664 wrote to memory of 1904	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	43
PID 2664 wrote to memory of 1904	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	43
PID 2664 wrote to memory of 1904	2664	{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe	43
PID 2772 wrote to memory of 1264	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	44
PID 2772 wrote to memory of 1264	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	44
PID 2772 wrote to memory of 1264	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	44
PID 2772 wrote to memory of 1264	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	44
PID 2772 wrote to memory of 2212	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	45
PID 2772 wrote to memory of 2212	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	45
PID 2772 wrote to memory of 2212	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	45
PID 2772 wrote to memory of 2212	2772	{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_23fee02cea008ff828bcb75854cf4e73_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
  C:\Windows\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
    C:\Windows\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
      C:\Windows\{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
        
        C:\Windows\{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
      - C:\Windows\{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
        
        C:\Windows\{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
        
        C:\Windows\{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
        
        C:\Windows\{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
        
        C:\Windows\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
        
        C:\Windows\{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
        
        C:\Windows\{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe
        
        C:\Windows\{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Windows\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe
        
        C:\Windows\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe
        12⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92A3B~1.EXE > nul
        12⤵
        
        PID:832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97961~1.EXE > nul
        11⤵
        
        PID:796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6A917~1.EXE > nul
        10⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{33DB4~1.EXE > nul
        9⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10DD9~1.EXE > nul
        8⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DAB5B~1.EXE > nul
        7⤵
        
        PID:2644
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8815E~1.EXE > nul
        6⤵
        
        PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BA906~1.EXE > nul
        5⤵
        
        PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{94463~1.EXE > nul
      4⤵
      PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{06E21~1.EXE > nul
    3⤵
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{06E2121E-776A-4c49-9B8E-D87BCF2B4BEF}.exe

Filesize
344KB

MD5
5a7bae03976adfac7446f3dc81f27963

SHA1
ced33142cd0e96cf0505d4d0760d14dcde3d5f01

SHA256
9cb9374256ec108f77f6094c2761f120df5bb39be2cbc958780535e6bdf4d394

SHA512
ab035a213f42f1f19de9103768e264499539db79f3fe50ca480d873778e1d10286754486bbe01a0b9b846fd84ddfda21ed5efb8ecd3f114220ec3a7890e3e893

Download Submit
C:\Windows\{10DD9DA0-3218-488d-BA31-8EF90320A001}.exe

Filesize
344KB

MD5
cc2fb3b4b29447cb0860830f0a16b679

SHA1
d5d56726ff4ff80a287eaff48878d57a8ea76bc3

SHA256
aa9a702d830d6083d63413f28ef0d1e04ac5a048f27e88bc5f9a9305495d1178

SHA512
7306d2e038705165f7382591b201cc93042fe241d2546258d3240a93729a4f1ec65444f275657cd48c376434a8dc3c42f6455f01a9b34adecb5a51f8c819257a

Download Submit
C:\Windows\{33DB41CC-64AF-4479-B715-6F8292EA11A4}.exe

Filesize
344KB

MD5
7bc7a318e7268dfb09063e68431512c5

SHA1
9aa5f99d502962df06885631990dc0fc2195b37e

SHA256
8f25606799f75e0f6c73a256763b42e1611e13e567cf8a1dcdc7239eea9015be

SHA512
6106a5ce170f1b70e25ecc5525ddb8204d4b5400d0568a50f7adf99924ea6fa11344ca6543bb3e81f6add9feea494545686ec164a44851c7c64b7ef54a73d37d

Download Submit
C:\Windows\{6A917C61-DDDF-4db1-8843-80088E2CF2AA}.exe

Filesize
344KB

MD5
f74078365cb9028dd7d2bfd5cbc0e9ff

SHA1
ccdb0c012ca84ec58f55fe8278d69c8f125a2f09

SHA256
63ae921b94efa1d8c4092fd87fe24739d99a6ae551f0d3398dc2c46403f4991f

SHA512
67f8bf21cd148e603f752722740dfd2087ecf91a86bd0b02466ded7ce82e9a29873e2d549cfe34670336231a0497a955acba9adf052e1c5bff8b8cd0a5feeb40

Download Submit
C:\Windows\{8815EF97-83A0-4363-B7F4-FF418844A65F}.exe

Filesize
344KB

MD5
189da4d5b0a2891e80172f8d6a866429

SHA1
4d76719000af87d6d31c7bec6bfbec63110ead59

SHA256
9c2f7cece125deefa56533275df3e0f75f2e4619ca0597cbeeab3f84ef824d96

SHA512
c0dfd7ddc0143e272e1276586f5c947a4eba980c572a2da7a443009bafe5c8219b6f2b675ccab97b9b5394dfe45b7a3f58cfdc18afcd21c30b8b261de4f39b22

Download Submit
C:\Windows\{92A3BC20-353F-4df5-96F9-98F6251D64AD}.exe

Filesize
344KB

MD5
15dff759aae730dfd09b3182dbd10e6d

SHA1
0e3315036cccaed2e9d3d93c382de8bbf1d9708a

SHA256
af20558bcf91333e99e22184c0a52635ecdc99fd4044562324a35d4d70f86559

SHA512
20a1bdd270931c513c9f1203c3d4755c8faf87d2e11cbf86087efe2c00de5071a4bd4cca6c162c688df79a3e94bc108fed5d37c0078d91411ac73ece00e6654c

Download Submit
C:\Windows\{94463EC2-6E2A-469e-901C-C4EAF0FA9F03}.exe

Filesize
344KB

MD5
ec7775719783a0ae5ab3d4d07a6d827c

SHA1
abea744cce18296313125acf0676bee89607349e

SHA256
c573f9db9e607ff0ab00779223af0badb80767ce2da0333cadcc842c35774b69

SHA512
86866a9c971e9f74105444c217f7ce0f24385062d453471eb32edd37f241a8d85faff0bf154af51ecb72225b6c981fcc63491197acdcca1f4bc7bec614ec2bbf

Download Submit
C:\Windows\{97961CF5-37D0-4f58-81E7-0C488A823B41}.exe

Filesize
344KB

MD5
272974a2f930a11cff8735e3b16af5a8

SHA1
673802efd3001603bfdbfff249857ea58265fb53

SHA256
5a1caab7d2be99742f1fe8ffe4ccac78b37c22c27ce44f2ac3409ced9ed720fc

SHA512
4fb26daaddbc117f435a3d0219aa6d3e826282e1e154e6dce9820447a8b77d312c16b918aa709e2fc6c81fe48566c770821f906a2f825bb0daa78cb1ff361753

Download Submit
C:\Windows\{BA906831-5017-4344-AC83-37AF7C4F1C0C}.exe

Filesize
344KB

MD5
d64458a058692ba17a57d8b99522152b

SHA1
483d3aa68c0ddb81ac54297f17cf9eb362fca31a

SHA256
c06b0e7689ca8e7b87680bdbe633cfcf060d8066e92048dee3a850b81c97f8cf

SHA512
7430150ca7b6d39ac0721bba7670666eedc0ef37ad046abe52050ffb74de379ae47d9ec7dc3b50d61e78a56a2f494d40dfe4841007f86f828d8e381951a44b56

Download Submit
C:\Windows\{DAB5B193-77DB-4b9c-8114-16BB2156160B}.exe

Filesize
344KB

MD5
7f0d7c361e2d680ebc93714715aa35e6

SHA1
7959ed8be4e3de25152a0343339d592b3e6385c8

SHA256
562c490b6dc8a698af5143c28c7de78c4cbc27514d929753c21d19961f818a4d

SHA512
ec1777227137a2b0fc07ec1832228da3f8bfd8aa10db4013079a35c6b2ca71ae20a33ffc59656f23471bb0e830d5bf6e5fcc8a51dc88c770c1da2c42956e0297

Download Submit
C:\Windows\{FEE8BE9A-4C1E-4a27-807B-070801A24D24}.exe

Filesize
344KB

MD5
fc83c3b6bf2847edda1a9ade7d55346e

SHA1
cef28ef0567e8bfe3e64acdeea6379761e6bdf4f

SHA256
16fcfc50d8b1d87f71179a6f886580a7c6836d5419d7a36a3578919ca156ca58

SHA512
470b3bc75cbc47b2c4be24c1541385ba9c1a4d209a15069edbae83f2bbb24e8a96f96b4a83f4c9286272be998bfc68b5f01a0c556d8eb3bb94c9209e70bb56ff

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads