f70224bf1613badf11cce9f03fda6e86f176da36dc6c4dcf164008ce4138dfb7

Analysis

max time kernel
144s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
Size

216KB
MD5

3322a9b5d365c0036849016c7b525ef5
SHA1

23b756e276ccbad1d9a47a82743bd0c93787da71
SHA256

f70224bf1613badf11cce9f03fda6e86f176da36dc6c4dcf164008ce4138dfb7
SHA512

3510db687915b53dd86294510b9996b1af843e2eb9fcc1eb74634357bac526dd88ed8748b3e5c2fe814185c3568f9d14025d268ea12771500bb6ae0e7f8a7e48
SSDEEP

3072:jEGh0oCl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGolEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015c54-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0023000000018afc-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0018000000018b25-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000900000000f6f2-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0024000000018afc-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a00000000f6f2-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0025000000018afc-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000b00000000f6f2-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0026000000018afc-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000c00000000f6f2-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0027000000018afc-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1E27C767-9BB0-4163-B9B3-761940058BD8}	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6679B785-CF86-44b7-B286-9A41110C84A8}	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}\stubpath = "C:\\Windows\\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe"	{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71BAE844-056B-4537-AF23-0244BF1861C9}\stubpath = "C:\\Windows\\{71BAE844-056B-4537-AF23-0244BF1861C9}.exe"	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C81A4BF-61CD-45ce-83A9-3188655600F0}	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2C81A4BF-61CD-45ce-83A9-3188655600F0}\stubpath = "C:\\Windows\\{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe"	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}\stubpath = "C:\\Windows\\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe"	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}\stubpath = "C:\\Windows\\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe"	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1E27C767-9BB0-4163-B9B3-761940058BD8}\stubpath = "C:\\Windows\\{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe"	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}\stubpath = "C:\\Windows\\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe"	{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{71BAE844-056B-4537-AF23-0244BF1861C9}	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}\stubpath = "C:\\Windows\\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe"	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6679B785-CF86-44b7-B286-9A41110C84A8}\stubpath = "C:\\Windows\\{6679B785-CF86-44b7-B286-9A41110C84A8}.exe"	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A18E0B67-5E75-4b08-97DD-68A62D123941}\stubpath = "C:\\Windows\\{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe"	{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A18E0B67-5E75-4b08-97DD-68A62D123941}	{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}	{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}	{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}\stubpath = "C:\\Windows\\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe"	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe

Deletes itself 1 IoCs

pid	Process
2560	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
2668	{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
1528	{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
1912	{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
1172	{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
File created	C:\Windows\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
File created	C:\Windows\{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
File created	C:\Windows\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe	{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
File created	C:\Windows\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe	{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
File created	C:\Windows\{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
File created	C:\Windows\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
File created	C:\Windows\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
File created	C:\Windows\{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
File created	C:\Windows\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
File created	C:\Windows\{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe	{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
Token: SeIncBasePriorityPrivilege	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
Token: SeIncBasePriorityPrivilege	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
Token: SeIncBasePriorityPrivilege	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
Token: SeIncBasePriorityPrivilege	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
Token: SeIncBasePriorityPrivilege	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
Token: SeIncBasePriorityPrivilege	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
Token: SeIncBasePriorityPrivilege	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
Token: SeIncBasePriorityPrivilege	2668	{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
Token: SeIncBasePriorityPrivilege	1528	{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
Token: SeIncBasePriorityPrivilege	1912	{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3032	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	28
PID 2216 wrote to memory of 3032	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	28
PID 2216 wrote to memory of 3032	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	28
PID 2216 wrote to memory of 3032	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	28
PID 2216 wrote to memory of 2560	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	29
PID 2216 wrote to memory of 2560	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	29
PID 2216 wrote to memory of 2560	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	29
PID 2216 wrote to memory of 2560	2216	2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe	29
PID 3032 wrote to memory of 2424	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	30
PID 3032 wrote to memory of 2424	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	30
PID 3032 wrote to memory of 2424	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	30
PID 3032 wrote to memory of 2424	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	30
PID 3032 wrote to memory of 2576	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	31
PID 3032 wrote to memory of 2576	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	31
PID 3032 wrote to memory of 2576	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	31
PID 3032 wrote to memory of 2576	3032	{71BAE844-056B-4537-AF23-0244BF1861C9}.exe	31
PID 2424 wrote to memory of 2492	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	34
PID 2424 wrote to memory of 2492	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	34
PID 2424 wrote to memory of 2492	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	34
PID 2424 wrote to memory of 2492	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	34
PID 2424 wrote to memory of 2956	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	35
PID 2424 wrote to memory of 2956	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	35
PID 2424 wrote to memory of 2956	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	35
PID 2424 wrote to memory of 2956	2424	{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe	35
PID 2492 wrote to memory of 324	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	36
PID 2492 wrote to memory of 324	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	36
PID 2492 wrote to memory of 324	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	36
PID 2492 wrote to memory of 324	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	36
PID 2492 wrote to memory of 268	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	37
PID 2492 wrote to memory of 268	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	37
PID 2492 wrote to memory of 268	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	37
PID 2492 wrote to memory of 268	2492	{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe	37
PID 324 wrote to memory of 564	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	38
PID 324 wrote to memory of 564	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	38
PID 324 wrote to memory of 564	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	38
PID 324 wrote to memory of 564	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	38
PID 324 wrote to memory of 2780	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	39
PID 324 wrote to memory of 2780	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	39
PID 324 wrote to memory of 2780	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	39
PID 324 wrote to memory of 2780	324	{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe	39
PID 564 wrote to memory of 1788	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	40
PID 564 wrote to memory of 1788	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	40
PID 564 wrote to memory of 1788	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	40
PID 564 wrote to memory of 1788	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	40
PID 564 wrote to memory of 868	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	41
PID 564 wrote to memory of 868	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	41
PID 564 wrote to memory of 868	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	41
PID 564 wrote to memory of 868	564	{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe	41
PID 1788 wrote to memory of 1392	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	42
PID 1788 wrote to memory of 1392	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	42
PID 1788 wrote to memory of 1392	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	42
PID 1788 wrote to memory of 1392	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	42
PID 1788 wrote to memory of 1760	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	43
PID 1788 wrote to memory of 1760	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	43
PID 1788 wrote to memory of 1760	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	43
PID 1788 wrote to memory of 1760	1788	{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe	43
PID 1392 wrote to memory of 2668	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	44
PID 1392 wrote to memory of 2668	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	44
PID 1392 wrote to memory of 2668	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	44
PID 1392 wrote to memory of 2668	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	44
PID 1392 wrote to memory of 312	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	45
PID 1392 wrote to memory of 312	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	45
PID 1392 wrote to memory of 312	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	45
PID 1392 wrote to memory of 312	1392	{6679B785-CF86-44b7-B286-9A41110C84A8}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_3322a9b5d365c0036849016c7b525ef5_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
  C:\Windows\{71BAE844-056B-4537-AF23-0244BF1861C9}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
    C:\Windows\{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
      C:\Windows\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
        
        C:\Windows\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:324
      - C:\Windows\{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
        
        C:\Windows\{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
        
        C:\Windows\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
        
        C:\Windows\{6679B785-CF86-44b7-B286-9A41110C84A8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
        
        C:\Windows\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
        
        C:\Windows\{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
        
        C:\Windows\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
        
        C:\Windows\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe
        
        C:\Windows\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe
        12⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2462F~1.EXE > nul
        12⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A18E0~1.EXE > nul
        11⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E2946~1.EXE > nul
        10⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6679B~1.EXE > nul
        9⤵
        
        PID:312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AC964~1.EXE > nul
        8⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1E27C~1.EXE > nul
        7⤵
        
        PID:868
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A0C8~1.EXE > nul
        6⤵
        
        PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB95F~1.EXE > nul
        5⤵
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2C81A~1.EXE > nul
      4⤵
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{71BAE~1.EXE > nul
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1CB5ACDC-1557-4857-BE93-F7B72D09C2A3}.exe

Filesize
216KB

MD5
d057b2589a23156ec8c5aae1df7b4794

SHA1
3cdc94492704873425e04e5387d56df570bf42d2

SHA256
fa8e948fb55c1c4f4f65d65628697664e0722e73ab9d917f13307931ccfbaa8a

SHA512
b7843c5e9bc0c1711624500ed816092c6f0749ad0fcbc4bb1f6c432f58b69f3301e828e8938e201623c058d23360489caf990345e60735fa9b1dad528a0f1f12

Download Submit
C:\Windows\{1E27C767-9BB0-4163-B9B3-761940058BD8}.exe

Filesize
216KB

MD5
4fe753730284a8eeebb07c0b7010786d

SHA1
6e061ab8e4349f2b4795f58cf5def44712c19ab6

SHA256
51358ae4cac6e1126a9c192715d4011f61067a307270cf08edd0a1056c434b30

SHA512
ec65c70146fbb91789d4a3f29ad8bff9dea629ed66ee4d957b4fd93cc1e70a081674bf51a033a1aa4112cb6a998f958129b52435f254df253fff1e4be2c17916

Download Submit
C:\Windows\{2462F0ED-1B4C-426b-85D1-E84F6F2B06CB}.exe

Filesize
216KB

MD5
4e35612c1b55949f0c53937d3c8afcb2

SHA1
19db8e1e30d4c7c3669449000ec11ec39ded592e

SHA256
9f4dcabbda1230ae619b338bb43c40c3f412e38d276f60cfc6340ffcaed443d2

SHA512
819717315a9b761ec20decafcfae43149ec7c8cb47174c52aecd5f8d82df7acfb4c8520b6b8c6dd523219f1c95ade68b57247d290456cb410c0526b19b92aa6e

Download Submit
C:\Windows\{2A0C82A7-717B-4aff-ADE5-9DC11A004A8C}.exe

Filesize
216KB

MD5
075e46400a3229a98078711931f1fea4

SHA1
3e4316c763c889c3ec8abd6c059602cc0a5d041c

SHA256
ba17261adcee7897647fd32bb73568e25752de77b935358a1abf0e370ac08408

SHA512
7796d23550f5489c95edbf3bd943b135b0f1b0e639f47204985dbdcad5a079c40590156ca13ca3858b6e24ac0c47e7eea96d84b024126b75b7a3ea6257e684b0

Download Submit
C:\Windows\{2C81A4BF-61CD-45ce-83A9-3188655600F0}.exe

Filesize
216KB

MD5
7c7a51fe5751b5578ff7c45dfe0d9cf8

SHA1
8a1257d4dcbb39774e776354e27423ce48fbd712

SHA256
4307fae279aeed8d5647c50a49ec8d0a496577f8076030fc086318c6621c8a99

SHA512
a846b2ce20e8cf4a02a0eed4e8e3efb094ee9b6fd30d7f47d3143783a141ff2dc48707355423fb893a2aaca8a056607e99c9a0f86097e33bdcdf5ecc9c2eb78a

Download Submit
C:\Windows\{6679B785-CF86-44b7-B286-9A41110C84A8}.exe

Filesize
216KB

MD5
91f11f09b2d4f22d98e50ca2c6d384ef

SHA1
903fc17c6bab1f976fe752e23e733e9e4f3c257f

SHA256
56a54ee83fbb7e960a458aa9df4d646e360c12aacf30e6d88ebb2b852b2f08f9

SHA512
355b02fe4334e187e892ec785b8c9c62e7ee4af00d799599927234b4523e4cd072d44346e6c814f47ac785cba09d0ce6996a93b9e9ff8c0592ab0d0ecbcedf7f

Download Submit
C:\Windows\{71BAE844-056B-4537-AF23-0244BF1861C9}.exe

Filesize
216KB

MD5
3e5ef94553593b098ef2450eafa651ba

SHA1
2b3152ae7a83fac0081caed917f8034e84fc4016

SHA256
df84a6e20d1f6515091ffe90178a386c91ae72b44028d6dfec57153326fd6e0b

SHA512
c408629c9064f19599970b8fed878a3cd1ac5a281e81ad86bb51b13e7faffc840a9190287a0d4837cb827c3a3613831a52be5a62eb27c22c60fa53be410dbaf4

Download Submit
C:\Windows\{A18E0B67-5E75-4b08-97DD-68A62D123941}.exe

Filesize
216KB

MD5
6192f57f46e6e6148c44a517f9a19700

SHA1
56c2a305e0ed56e42bebcfda1cc9f0421bb06033

SHA256
dd0c10cdb8bfb0970ded96faab56a0bec45e4f42cede0c25819415d68f909925

SHA512
a21933ec169fb6e3612b63907676261e607aa6c046acf819c52e29d3c34436629f9f96fad816871d9e2914b631e1d1dab1e6a3bd8addd534cbeb017e74c84ae6

Download Submit
C:\Windows\{AC964124-004C-4ebb-AD81-2E3DF8E73E9B}.exe

Filesize
216KB

MD5
5040704051408a48422ea1dedd8f265f

SHA1
ebe3733e9605154ebaaf20e77294e36c75b07c61

SHA256
71204112b7f7369290a42cfa92883589edbda00046218cb0a903e1ee3da6ccc7

SHA512
666c20cd710a17aee00f28bef6b2fabf352e0b440d0450ea0922261ecbe7dac49baa07861933457e3f1afd66b28812ed3bd2e7f81d62644af6b7635a7d9fa23f

Download Submit
C:\Windows\{DB95F53A-ACEE-411c-B2A8-52AF552E0DAF}.exe

Filesize
216KB

MD5
8707c5db6cdc8cc43db8bf4d5ba62b7f

SHA1
20ce6fa6b33c2d938800603bfede6346f053d5a7

SHA256
65dc6abe9324a409b41326a7b21114a11bab2583e005bdc6e4e85574052ec513

SHA512
963dbe6da4b3a4a0f5d849d9db2a1ec4ed07888746a2d9407407c53a17e32f75b8eb576637ceac101cb46e824565d9ba87b05aaf3765d11a74c8d9a665c17319

Download Submit
C:\Windows\{E2946778-2BD0-4c71-A8F3-C03A7D1F6049}.exe

Filesize
216KB

MD5
929d6c2dd3d907941b5d738e8a01baac

SHA1
9df039d046182052bc385fc4c9b0bec68fac2bf6

SHA256
1c751f9f380656c705c9661a443e5b4c945628dc73bae8042bb7a2740b441a6d

SHA512
f33155dc6ac898ed0d6d241a9371bbe4db5e198ebf3089d98a8d5caea64f860dff197917831fa9ca4dc540648cbb5fca10654841f03e6bd92823e97a3b9955d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads